Mercado Bitcoin Loses $40M in Hot Wallet Drain Across 10 Chains

Brazil's largest crypto exchange, Mercado Bitcoin, halted all deposits and withdrawals on Monday after wallets it operates moved more than $40 million in digital assets to attacker-controlled addresses across at least 10 blockchains. The exchange said it contained the breach and that no customer lost funds and no data leaked, but it did not confirm the $40 million estimate or explain how the attacker got in.

"We identified and quickly contained a security incident in one of our systems early this morning," Mercado Bitcoin said in a statement on X posted November 2. The exchange paused its payment rails as a precaution while it investigates, traces the stolen assets and works with law enforcement.

What does the transaction pattern reveal?

The transfers were plain wallet-to-wallet transactions, not smart contract calls, according to a report relayed by Pablo Sabbatella, founder of crypto security firm Opsek. A plain transaction requires only the sender's private key. A contract exploit, by contrast, abuses a bug in on-chain code and typically appears as a single crafted call rather than hundreds of routine sends.

That pattern points to stolen signing keys for the exchange's hot wallets — the internet-connected wallets exchanges use to process withdrawals at speed. The largest outflow window ran from 06:19 to 06:53 UTC, roughly half an hour in which wallets on nearly a dozen chains emptied at once, according to the report. Chains affected include Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC and Stellar.

A drain this broad suggests operational keys were exposed in bulk. Cold storage and multi-party signing exist precisely to keep such keys offline and split them apart; Mercado Bitcoin's incident implies neither control contained the exposure. The tally from the Opsek analysis puts the attacker's current holdings at about 2,852 ETH, 106 BTC, 10,700 SOL, 77,000 AVAX and 6.7 million XLM, with smaller positions spread across roughly 200 additional tokens. Those figures come from a single on-chain analysis; the exchange has not verified them. Security firm Hypernative also produced a $40 million estimate.

In a follow-up post, Mercado Bitcoin published the destination addresses it identified on five networks — EVM chains, Bitcoin, Solana, Stellar and Tron — so other services can track the funds.

What has recovery achieved so far?

Tether moved first. "Tether froze more than 4.5M USDT related to this security incident," CEO Paolo Ardoino said on X. Tether can blacklist addresses holding its dollar-pegged stablecoin, preventing the tokens from moving, but a freeze does not by itself return funds to their owner.

The freeze also covers only a slice of the loss. Most of the attacker's holdings sit in ETH, BTC, SOL, XLM and AVAX — assets no issuer can unilaterally freeze. Recovery of the bulk of the stolen funds will depend on exchange-level monitoring of the published addresses, law enforcement action and any attacker mistakes, not on issuer intervention.

Is this connected to the Binance breach?

The incident lands four days after hackers drained more than $6 billion from Binance on October 29, a theft the FBI attributed to North Korea's TraderTraitor group. Binance has since reopened withdrawals and said it replenished about 95% of the affected assets. That attack reportedly came through compromised operational access rather than chain-level code — the same failure category the Mercado Bitcoin transfers suggest.

No attribution has been made in the Mercado Bitcoin case, and there is no public evidence linking the two incidents. The shared pattern, bulk-compromised operational credentials rather than vulnerable smart contracts, is what connects them so far.

Deposits and withdrawals at Mercado Bitcoin remain suspended, and the exchange has not given a date for resuming them. Until it discloses the intrusion vector, the operational-key exposure that the transaction pattern indicates remains the working hypothesis for how $40 million left its wallets in half an hour.