Mercado Bitcoin wallets kept moving funds after $46M hack, with $6.2M frozen

Mercado Bitcoin, one of Brazil’s largest Bitcoin exchanges, confirmed a security incident after more than $46 million worth of cryptocurrency was drained from wallets on Monday. The detail that matters for PSPs and exchanges: even after the company said deposits and withdrawals were suspended, addresses linked to the breach kept receiving funds for hours.

1. Security firms said the attack was carried out through standard transfers, not a smart contract exploit. Certik senior security engineer Dickson Wu posted an initial post mortem saying the attackers “picked at eight small chains for four hours,” including Base, Optimism and Arbitrum, before moving to the company’s main hot wallets.
2. Wu said the attackers then transferred tiny amounts of Ether (ETH) from 27,160 different addresses. His conclusion was blunt: “So whoever did this can also move money out of MB’s customer deposit addresses,” which is the part that should make any exchange operator stare at its wallet architecture a bit longer than planned.
3. Hours after Mercado Bitcoin announced a temporary suspension of deposits and withdrawals, funds were still moving out of addresses tied to the breach, followed by thousands of small ETH transfers into a single address. The company told Cointelegraph that customers had suffered no losses and no data had been leaked, but it did not respond to requests for comment on the continued transfers.
4. By 16:42 UTC, approximately $6.2 million had been frozen by stablecoin issuers Tether and Circle. About $20 million had been moved into newly created wallets, while over $20 million remained in associated addresses identified by Mercado Bitcoin, including all 106 BTC.
5. Mercado Bitcoin had 4.5 million users as of July, when Tether announced a $20 million investment to support its expansion in tokenization, payments and credit. The incident also matters for Brazilian compliance teams because a data breach could trigger notification requirements to Brazil’s data protection authority, and the hack has not yet been attributed to an organized group.

Mercado Bitcoin is not the only Latin American exchange in the frame here. Another Tether-backed exchange in the region, Chile’s Orionx, announced its closure in September after a forensic audit found that more than $7 million in customer assets had moved to wallets outside its control. Days later, Binance reported a $6.3 billion hack targeting its hot wallets on Thursday, suspended deposits and withdrawals, and said it had replenished 95% of the stolen assets before beginning to resume withdrawals on Sunday.