Mercado Bitcoin temporarily suspended deposits and withdrawals this Monday (2), after confirming a security incident that occurred overnight. While the Brazilian exchange says it contained the attack and denies losses to customers, researchers identified suspicious cryptocurrency movements on ten blockchains, with values estimated at US$ 48.5 million.
The security firm Hypernative had initially warned of transfers exceeding US$ 40 million, involving wallets attributed to the platform. Later, Bitquery published a more comprehensive tracking, with addresses, times and values of the transactions.
In a statement released on X, Mercado Bitcoin said it quickly identified and contained an incident in one of its systems. The exchange stated that no customer suffered losses and that there was no data leak.
The company also said its teams are investigating the episode, tracking the assets and coordinating measures with the competent authorities. It did not disclose the amount of the resources involved or set a deadline for resuming operations.
According to Bitquery, the transfers originated from operational wallets associated with the exchange on ten blockchain networks, concentrated within approximately 25 minutes. On Ethereum alone, the company identified US$ 29.5 million moved, including 2,852 ETH and different tokens.
The total value of US$ 48.5 million was calculated based on asset prices at the time of the transactions. This is an independent estimate, not a loss officially recognized by Mercado Bitcoin.
Tracking identifies transfers after containment announcement
The main contrast between the exchange's position and the technical data appears in the chronology of the movements.
According to Bitquery, the company statement was published at 9:56 a.m., Brasília time, while deposit addresses attributed to the platform continued transferring funds until at least 12:44 p.m.
The survey identified 35,853 deposit addresses on Ethereum that sent their balances to an address associated with the possible attacker. These movements totaled approximately US$ 261,000.
Deposit addresses are used to receive cryptocurrencies sent by users before their transfer to the exchange's operational wallets. According to the researchers, the observed behavior suggests that the party responsible for the movements was also able to use authorization mechanisms on these wallets.
The activity recorded after the statement shows that certain transfers continued to occur, but does not, by itself, clarify the technical scope of the containment announced by Mercado Bitcoin.
The analysis also identified approximately US$ 7.3 million in frozen assets by issuers Tether and Paxos. The freeze restricts the movement of these tokens, but does not necessarily represent the definitive recovery of the funds.
Bitquery's conclusions depend on the correct attribution of the addresses to the exchange and on the assessment of the transferred assets. Public blockchain records also do not make it possible to determine whether the amounts moved belonged directly to customers or whether the company will be able to fully absorb any losses.
As of the information released on November 2, the technical origin of the incident, the definitive financial loss and the date for normalization of deposits and withdrawals remained without public confirmation.
