Mercado Bitcoin Says There Was 'No Loss to Customers'. The Attacker Still Reached 27,160 Customer Deposit Addresses and Walked Off With About $46M
“Não houve nenhum prejuízo aos clientes.” There was no loss to customers. That’s how Mercado Bitcoin, Brazil’s largest crypto exchange, described Monday’s breach.
On-chain analysts tell a different story about the exchange itself. They tracked more than $40 million leaving its wallets across at least 10 blockchains. Arkham puts the attacker’s haul at about $46 million. And a CertiK engineer says the attacker could reach 27,160 customer deposit addresses.
The customers may well be made whole. But “contained” is carrying a lot of weight here.
What Happened
Early on Monday, November 2, Mercado Bitcoin posted on X:
“Identificamos e contivemos com rapidez um incidente de segurança em um de nossos sistemas nesta madrugada. Reforçamos que: • Não houve nenhum prejuízo aos clientes; • Não houve vazamento de dados.”
In English: “We identified and quickly contained a security incident in one of our systems early this morning. We emphasize: there was no loss to customers; there was no data leak.” As a “preventive protection measure,” the exchange suspended all deposits and withdrawals.
It didn’t say which system was hit, how much was taken, or when withdrawals would come back. As of the latest reports, they’re still off and there’s no reopening date.
The Numbers the Exchange Won’t Give
Mercado Bitcoin hasn’t put a figure on it. Here’s what others have found:
- Hypernative flagged more than $40 million in suspicious transfers to newly created addresses on at least 10 blockchains, including Bitcoin, Ethereum, Solana and Tron (via Decrypt).
- Arkham attributes about $46 million to attacker wallets. CryptoSlate’s breakdown names $8.37M in ETH, $8.24M in BTC and $1.76M in PEPE.
- Mercado Bitcoin itself later published the destination addresses on five networks: Bitcoin, EVM chains, Solana, Stellar and Tron. It said they were shared “exclusively for identification and tracking purposes.”
Mercado Bitcoin hasn’t confirmed any of these numbers.
Four Hours of Warm-Up, Then the Hot Wallets
The most detailed account comes from Dickson Wu, a senior security engineer at CertiK, as reported by Cointelegraph:
- The attacker “picked at eight small chains for four hours.” Those included Base, Optimism and Arbitrum.
- Then they moved to the main hot wallets.
- Tiny amounts of ETH were sent from 27,160 different addresses. Wu’s read: “So whoever did this can also move money out of MB’s customer deposit addresses.”
- Hours after the exchange announced the pause, Wu says, funds kept moving out of addresses tied to the breach. That was followed by thousands of small ETH transfers into a single address.
In other words, the warm-up ran for four hours before the big drain. And according to Wu, money was still moving after the “quickly contained” post went up.
Security firms told Cointelegraph this wasn’t a smart contract exploit. The funds left through standard transfers, which points at whoever, or whatever, controls the signing keys.
The Freeze Tally
Stablecoin issuers moved faster than the exchange’s disclosures:
- Tether CEO Paolo Ardoino: “Tether froze more than 4.5M USDT related to this security incident.”
- By 4:42 pm UTC Monday, Cointelegraph counted about $6.2 million frozen by Tether and Circle.
- CryptoSlate, citing Specter, later reported more than $9 million immobilized across nine assets, including USDC, PAXG and RLUSD.
Cointelegraph also reported that more than $20 million, including all 106 BTC, was still sitting in the attacker-linked addresses Mercado Bitcoin identified. About another $20 million had already moved into fresh wallets.
One awkward detail: Tether invested $20 million in Mercado Bitcoin in July to fund its push into tokenization, payments and credit. Four months later, it’s freezing the USDT that walked out of the same exchange.
Who Did It?
Nobody knows yet. Cointelegraph says the hack hasn’t been attributed to an organized group. Mercado Bitcoin says it’s “coordinating with the relevant authorities,” but hasn’t said which ones.
The timing is still hard to ignore. The breach landed days after the FBI pinned the $6.3B Binance hack on North Korea’s TraderTraitor. No investigator has linked the two incidents, and the attack patterns described so far are different. Consider it unconfirmed.
On the bill, Bitcoin Magazine, citing Bloomberg, reports the exchange will absorb all losses. With 4.5 million users as of July, it can probably afford to. The bigger problem is that a lot of people currently can’t get their money out.
Why This Matters for Crypto Jobs
Exchange security just had a brutal fortnight. Binance lost $6.3B. CoinDCX had its “operational losses.” Now Brazil’s biggest exchange is down. Every exchange board is asking the same question this week: could our hot wallets survive four hours of someone quietly probing them? The people who can answer that, in wallet infrastructure, key management and detection engineering, have never had more leverage.
Monitoring roles just justified themselves. By Wu’s account, the attacker spent four hours on Base, Optimism and Arbitrum before going for the main wallets. That’s a four-hour window for anyone watching withdrawal patterns across chains to raise the alarm. Every exchange runs on more chains than it monitors well, and multi-chain SOC analysts and on-chain monitoring engineers are the fix.
LatAm is a real hiring market. Mercado Bitcoin serves millions of users and draws strategic money from Tether. Brazil is one of crypto’s biggest retail markets. Incident response, compliance and security roles in São Paulo, and remote roles for LatAm-focused exchanges, will get easier to justify after Monday.
Incident comms is a skill, not an afterthought. “No loss to customers” can be true and still read badly when Arkham is showing $46M on a dashboard. Exchanges need people who can publish addresses, numbers and timelines quickly, without overpromising.
The Bottom Line
Mercado Bitcoin says it contained the breach and that customers won’t lose a cent. Maybe both turn out to be true. But the only dollar figures so far come from Arkham, Hypernative and CertiK, not the exchange. By those accounts, the attacker had four hours of warm-up, reached 27,160 deposit addresses, and was still moving funds after the pause.
Until Mercado Bitcoin publishes a post-mortem, the block explorers are writing it.
Want to be the one who spots the four-hour warm-up before the hot wallets go? Exchanges are hiring for security engineering, wallet infrastructure and on-chain monitoring. Browse open roles on Cryptogrind →
Discussion
Comments are powered by GitHub. Sign in with your GitHub account to chime in.