Mercado Bitcoin Freezes Withdrawals as Watchers Flag a $40M Drain

Brazilian crypto exchange Mercado Bitcoin suspended deposits and withdrawals on Monday after what it called a security incident in one of its systems, as outside trackers flagged more than $40 million in outflows.

In an official statement on X posted at 7:56 a.m. ET, the exchange said in Portuguese that it found and contained the incident overnight, that clients suffered no losses and that no data leaked. It has not given a loss figure. It has not called the event a hack.

Outside trackers put numbers on it. Blockchain security firm Hypernative estimated that more than $40 million left wallets it ties to the exchange, according to an alert shared by Opsek founder Pablo Sabbatella and reported by Unchained. Arkham Intelligence groups 36 addresses holding about $46 million, The Defiant reported. Mercado Bitcoin has not confirmed either figure.

Hypernative's count includes about 2,852 ETH, 106 BTC, 10,700 SOL and 6.7 million XLM, plus more than 200 other tokens, spread across at least 10 chains. The 106 BTC alone is worth roughly $8.2 million at Monday's price near $77,400, based on CoinGecko data.

How did the money move? Hypernative described the outflows as plain transfers rather than a smart contract exploit. In plain words, whoever moved the funds appears to have had the power to sign transactions from the exchange's own wallets, the way the exchange itself would. A smart contract exploit, by contrast, tricks a program's code into paying out. Hypernative said it was still unclear how that signing access was obtained. Most of the funds moved in a 34-minute window starting at 1:19 a.m. ET, it said.

About 90 minutes after its first post, the exchange published the destination addresses on EVM networks, Bitcoin, Solana, Stellar and Tron so others can track them. It says it is working with authorities and will reopen once it is safe.

The pause lands four days after Binance's Oct. 29 hot-wallet drain. No one has tied the two events together.

In our opinion: The exchange's promise that clients lost nothing is the line to hold it to, and the fastest proof is a dated reopening with balances intact. Publishing the addresses early was the right call, since it gives trackers and other exchanges a head start on freezing funds. Watch for a loss figure and an explanation of how signing keys were reached, because that answer matters to every exchange running hot wallets.