Brazil's leading crypto asset (virtual currency) exchange Mercado Bitcoin said on the 4th via its official X account that assets lost through unauthorized access detected on the 2nd currently total $36.3 million. It said $12.9 million of that has already been blocked, and indicated a policy of continuing to suspend services until a safe resumption can be confirmed.
The company explained that it activated security and governance procedures immediately after detection and reported the matter to authorities. It emphasized its position that the suspension of deposits and withdrawals is a protective measure, that no losses have been incurred by customers, and that it will not pass on the damage from the hack to users. In tracing the lost assets, it is working with protocols and exchanges around the world to identify and freeze assets connected to the attack, and has requested that other on-chain services block the addresses. It said it is also receiving support from security specialists, asset issuers, and independent investigators.
Estimates of the scale of the outflow vary. Blockchain security firm Hypernative initially calculated it at more than $40 million. Arkham Intelligence estimated roughly $46 million. The attacker is said to hold approximately 106 bitcoin (BTC), about 2,852 ether (ETH), roughly 10,700 solana (SOL), about 6.7 million stellar lumens (XLM), and around 77,000 avalanche (AVAX), plus more than 200 types of tokens spread across new addresses. The funds span at least 10 blockchains, including Ethereum, Bitcoin, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain, and Stellar Lumens.
Hypernative classified the outflow as "not a smart contract vulnerability but a simple transfer," and said it is unclear how the attacker obtained signing authority. The fact that the transfers were recorded as approved by the sending wallets themselves suggests not a flaw in the code but a possible compromise of keys or signing infrastructure. Mercado Bitcoin later published the destination addresses so that outside parties could monitor and trace the funds.
Paolo Ardoino, CEO of major stablecoin issuer Tether, confirmed on X that more than 4.5 million USDT connected to the incident had been frozen. Tether invested $20 million in Mercado Bitcoin in July, and the company had said it has 4.5 million users. Arkham analyst Emmett Gallic noted that the attacker remained active the same day, moving funds from old deposit addresses while selling meme coins and altcoins.
The incident comes at a time of successive record-scale exchange attacks. It follows immediately after a $6.3 billion Binance breach that the U.S. Federal Bureau of Investigation (FBI) identified as the work of North Korea's "TraderTraitor" group. The February 2025 Bybit breach of $1.5 billion and the roughly $388 million outflow at Bitget in September of the same year have also occurred, and compromise of signing infrastructure or third-party tools has emerged as a common modus operandi.
Mercado Bitcoin has not specified when deposits and withdrawals will resume, and appears set to restore functions in stages, starting with those that have passed safety checks. The market focus will be on the recovery status of frozen assets, the findings of the investigation into how signing authority was seized, and whether the policy of absorbing losses itself rather than passing them on to customers will be maintained once the full scope of the outflow becomes clear.
Note: Amounts are based on company statements and estimates at the time of reporting.
