The Brazilian exchange said it contained the incident early Monday and that no customer lost money, but it has published no loss figure of its own. Hypernative traced more than $40 million out of wallets it attributes to Mercado Bitcoin across at least 10 chains, and The Block put the sum at about $46.3 million.
Mercado Bitcoin suspended deposits and withdrawals on Monday after what it called a security incident in one of its systems, and the blockchain security firm Hypernative estimated that more than $40 million had drained from wallets it attributes to the Brazilian exchange.
The exchange posted its first statement on X in Portuguese. In the English wording reported by The Block, it said it had "identified and swiftly contained a security incident in one of our systems early this morning," that customers had not been affected and that no data had been breached. It described the suspension as a precaution while its teams investigate, trace the assets and coordinate with authorities, and said it was working to restore operations safely. It has not called the episode a hack, has not given a loss figure and has not said whose funds moved.
Later on Monday cryptonews.net reported that the exchange had told users it would absorb the losses itself. That report does not quote the statement directly and names no spokesperson, and the exchange has still confirmed no figure, so what is on the record is a commitment to cover an amount the company has not stated.
Hypernative described the transactions as plain transfers rather than a smart contract exploit, which moves the question to how the attacker came to hold signing access to the wallets. The firm said it was not clear how that access was obtained. Pablo Sabbatella, the founder of the security firm Opsek, circulated the alert on X.
By Hypernative's account most of the money moved between 06:19 and 06:53 UTC, with sweeps of the exchange's bitcoin deposit addresses starting earlier, at 02:15 UTC. It counted emptied wallets on at least 10 chains, naming Ethereum, Bitcoin, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain and Stellar, and put the attacker's holdings at about 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and 77,000 AVAX alongside more than 200 other tokens. Mercado Bitcoin has confirmed none of those figures.
About 90 minutes after its first post the exchange published the destination addresses on EVM networks, Bitcoin, Solana, Stellar and Tron, saying it was sharing them only so the assets could be identified and tracked. That disclosure is the one part of the on-chain account that comes from the exchange itself, and it makes the destinations checkable by anyone. Unchained reviewed the bitcoin address and found it had received about 106.07 BTC across seven transactions, the first in a block timestamped 05:42 UTC and a single transfer of 104.43 BTC at 06:41 UTC, with none of it moved on as of 14:58 UTC. That matches Hypernative's bitcoin count.
The totals in circulation do not agree. The Block put the sum at about $46.3 million, citing Arkham data for an entity it labels the Mercado Bitcoin hacker. That measures something different from Hypernative's estimate. A balance held by a labeled entity depends on which addresses the labeler assigns to the attacker and on when the snapshot is taken, while Hypernative's figure covers what left wallets it attributes to the exchange. Neither number is the exchange's own.
Tether's chief executive, Paolo Ardoino, said on X that the company "froze more than 4.5M USDT related to this security incident." A freeze blocks the tokens from moving, which is not the same as returning them to the exchange or to its customers. Tether's authority to impose one is itself the subject of a lawsuit, in which the payments company Conduit has asked a court to rule that Tether had no right to freeze its USDT.
The incident came four days after large drains from Binance hot wallets, for which that exchange reserved more than $6.34 billion of company funds. Neither Mercado Bitcoin nor Hypernative has linked the two, and CoinDesk reported that no public evidence connects them. Polymarket also paused trading in late October and blamed a compromised third-party provider.
What the exchange has not said is how much left, how the attacker obtained signing access, and when deposits and withdrawals will reopen. Its statement that customers were unharmed rests on its own accounting, which no outside party has examined, and the only loss figures in public are estimates read off the chains rather than off the exchange's books.
