What to Know

  • Mercado Bitcoin suspended deposits and withdrawals on Monday after wallets tied to the Brazilian crypto exchange were drained across at least 10 blockchains.
  • Security firms estimate the losses at more than $40 million.
  • The exchange said it identified and swiftly contained the incident, adding that customers were not harmed and no data breach occurred.
  • The largest outflows were tracked between 06:19 and 06:53 UTC, when funds moved from wallets on Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC, Stellar and other chains to fresh addresses.
  • The attacker is said to hold roughly 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and 77,000 AVAX, plus more than 200 other tokens.
  • The transfers were plain transactions rather than a smart contract exploit, leaving the key question focused on how signing access was obtained.
  • Mercado Bitcoin published destination addresses on EVM chains, Bitcoin, Solana, Stellar and Tron to help the market track the funds.
  • No attribution has been made, and there is no public evidence linking the incident to the recent Binance hack that the FBI attributed to North Korea’s TraderTraitor group.
  • Tether founder Paolo Ardoino confirmed that $4.5 million worth of USDT linked to the hack has been frozen.

Mercado Bitcoin Freezes Transfers After Cross-Chain Wallet Drain

Mercado Bitcoin has suspended deposits and withdrawals after a security incident emptied wallets connected to the platform across at least 10 blockchains, creating one of the most closely watched exchange security events in the crypto market. Security firms estimate the loss at more than $40 million, while the Brazilian exchange says it has contained the incident and is continuing to investigate alongside asset-tracking teams and authorities.

The pause on deposits and withdrawals was described by the exchange as a precautionary step while its teams assess the movement of funds and monitor destination wallets. Mercado Bitcoin said customers were not harmed and that no customer data was breached, a key distinction for users concerned about both asset safety and personal information. The exchange’s public position is that the compromise was identified quickly and contained, even as normal transfer activity remains halted during the review.

The incident adds fresh pressure to centralized crypto platforms at a time when security scrutiny is already elevated. Exchange wallet infrastructure remains a prime target because successful access to signing systems can allow attackers to move funds quickly across chains without needing to exploit a smart contract. In this case, security researchers tracking the flows have characterized the transfers as plain transactions, not a smart contract exploit, which places attention on operational security, private key handling, access controls and internal wallet management procedures.

Outflows Hit Multiple Major Blockchains

Blockchain monitoring shared by crypto security specialists indicates that the biggest outflows occurred between 06:19 and 06:53 UTC. During that window, wallets on Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC, Stellar and other chains sent most of their funds to newly created addresses. The breadth of networks affected suggests the attacker had access to signing authority across a broad set of wallet environments rather than exploiting a weakness isolated to one blockchain.

The attacker is believed to hold roughly 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and 77,000 AVAX, along with more than 200 other tokens. Those balances reflect a wide mix of liquid crypto assets and long-tail tokens, which can make recovery and tracing more complex. Highly liquid assets can be moved, bridged or swapped quickly, while smaller tokens may be harder to offload without drawing attention or affecting market pricing.

Mercado Bitcoin later published destination addresses across EVM chains, Bitcoin, Solana, Stellar and Tron. Publishing those addresses is a common containment and recovery tactic in major crypto thefts, as it allows exchanges, stablecoin issuers, analytics firms and market participants to flag associated wallets. Once addresses are widely identified, attackers may find it harder to move funds through compliant platforms, although tracing across networks can still be difficult when assets are split, swapped or routed through multiple wallets.

Exchange Says Customers Were Not Harmed

Mercado Bitcoin said it had identified and swiftly contained the security incident. The exchange also stated that there was no harm to customers and no data breach. That message is important for user confidence because crypto exchange incidents can involve different categories of risk, including loss of company-controlled assets, loss of customer funds, leakage of user information or disruption to deposits and withdrawals. Mercado Bitcoin’s statement places the event in the category of a wallet security incident while asserting that customers did not suffer direct harm.

Even so, the suspension of deposits and withdrawals creates practical disruption. Users may be unable to move funds into or out of the platform until Mercado Bitcoin completes enough internal checks to safely resume operations. In exchange security incidents, platforms typically need to determine which systems were accessed, whether any credentials remain exposed, whether wallet signing processes are secure, and whether additional addresses or networks could be at risk. That work can take time because restoring transfers too quickly can create further exposure if the root cause has not been fully addressed.

The exchange is also coordinating with authorities and tracking the assets. Recovery in crypto theft cases often depends on speed, transparency and cooperation across the industry. When stolen assets touch centralized venues or stablecoin systems, there may be opportunities to freeze or recover portions of the funds. When attackers keep funds in self-custody or move them through decentralized infrastructure, the process becomes more complicated and may depend heavily on on-chain intelligence.

USDT Freeze Highlights Stablecoin Intervention

Tether founder Paolo Ardoino confirmed that $4.5 million worth of USDT linked to the hack has been frozen. Stablecoin freezes can be significant in hack response efforts because issuers may have the ability to block transfers of tokens associated with illicit activity. While such measures do not recover every asset involved, they can prevent a portion of stolen funds from circulating further and may support broader law enforcement or recovery work.

The freeze also underscores the difference between various crypto assets after a theft. Some tokens include issuer-controlled mechanisms that can stop movement when addresses are flagged. Other assets, including many native blockchain coins, do not have the same centralized freeze function. As a result, the recovery path can vary widely depending on which assets were taken, where they moved and whether they interact with services that can respond to illicit-flow alerts.

The Mercado Bitcoin incident comes days after the FBI attributed a separate Binance hack to North Korea’s TraderTraitor group. That Binance breach involved more than $6 billion and has been described as the largest crypto hack on record. The timing has drawn attention across the market, but no attribution has been made in the Mercado Bitcoin case, and there is no public evidence linking the Brazilian exchange incident to the Binance attack.

That distinction matters. Large crypto thefts can cluster in news cycles, and attackers may use similar methods or target similar infrastructure, but timing alone does not establish responsibility. In the Mercado Bitcoin case, the central unresolved issue is how the attacker obtained signing access. Until investigators clarify whether the incident involved compromised credentials, internal system access, social engineering, malware, infrastructure misconfiguration or another path, attribution remains speculative.

North Korea-linked crypto theft remains a major concern for the digital asset industry, particularly when state-backed groups target exchanges, custodians and wallet infrastructure. However, responsible coverage of incidents requires separating confirmed facts from assumptions. For Mercado Bitcoin, the confirmed picture is a cross-chain wallet drain, a transfer suspension, exchange assurances that customers and data were not harmed, and ongoing efforts to trace and contain the funds.

Why Signing Access Is the Central Question

Because the transfers were described as plain transactions rather than a smart contract exploit, the most important technical question is how the attacker gained signing access. In crypto, signing authority is what allows a wallet to approve transactions. If an attacker can sign on behalf of a wallet, funds can be moved in a way that looks like a normal transaction on-chain, even though the transfer is unauthorized from the platform’s perspective.

That kind of incident is often more challenging to interpret from blockchain data alone. On-chain records can show where funds went, how quickly they moved and which networks were involved, but they do not automatically reveal how access was obtained. The cause may sit off-chain, inside access management systems, cloud environments, operational workflows or key custody arrangements. For exchanges, the incident is a reminder that wallet security depends on both blockchain monitoring and strict internal controls around keys, approvals and transaction authorization.

For users, the immediate focus will be on when deposits and withdrawals resume and whether the exchange provides additional detail on the safeguards put in place. Mercado Bitcoin’s assurance that customers were not harmed may reduce panic, but market confidence typically depends on visible remediation, transparent updates and evidence that the compromised pathway has been closed.

Market Impact and Industry Response

The Mercado Bitcoin hack is likely to reinforce the importance of cross-chain monitoring and rapid industry coordination. Modern exchanges often support many networks, and that creates a larger security perimeter. A weakness affecting signing operations can therefore have consequences across multiple chains at once, as seen in the movement of assets from Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC, Stellar and other networks.

Crypto security teams will be watching the destination wallets for attempted swaps, bridges, deposits or fragmentation into additional addresses. Market participants will also monitor whether more stablecoin issuers, exchanges or infrastructure providers take action against flagged addresses. The publication of destination addresses by Mercado Bitcoin gives the broader industry more data to work with, but recovery outcomes remain uncertain.

For now, the clearest takeaway is that Mercado Bitcoin has contained the immediate incident, paused transfers as a precaution and begun a public tracking effort. The unresolved questions are how signing access was obtained, whether any additional funds can be frozen or recovered, and when full platform functionality will return. Until those issues are answered, the hack will remain a major security focus for the crypto market.

Frequently Asked Questions (FAQs)

What happened to Mercado Bitcoin?

Mercado Bitcoin suspended deposits and withdrawals after wallets tied to the Brazilian crypto exchange were drained across at least 10 blockchains. Security firms estimate the losses at more than $40 million.

Were Mercado Bitcoin customers affected?

Mercado Bitcoin said customers were not harmed and that no data breach occurred. The exchange described the suspension of deposits and withdrawals as a precaution while it investigates and tracks the funds.

Which blockchains were involved in the hack?

Funds moved from wallets on Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC, Stellar and other chains. Mercado Bitcoin also published destination addresses across EVM chains, Bitcoin, Solana, Stellar and Tron.

How much crypto did the attacker receive?

The attacker is said to hold roughly 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and 77,000 AVAX, plus more than 200 other tokens. Security firms estimate the total loss at more than $40 million.

Was this a smart contract exploit?

The transfers were described as plain transactions rather than a smart contract exploit. That means the key unresolved issue is how the attacker obtained signing access to move funds from the affected wallets.

Has anyone been blamed for the Mercado Bitcoin hack?

No attribution has been made. There is also no public evidence linking the Mercado Bitcoin incident to the separate Binance hack attributed by the FBI to North Korea’s TraderTraitor group.

Was any of the stolen crypto frozen?

Tether founder Paolo Ardoino confirmed that $4.5 million worth of USDT linked to the hack has been frozen. Stablecoin freezes can help limit the movement of some stolen assets, though they do not address every token involved.

When will Mercado Bitcoin resume deposits and withdrawals?

Mercado Bitcoin has not provided a confirmed timeline in the available public details. Transfers remain paused as a precaution while the exchange investigates, tracks assets and coordinates with authorities.