Brazil's Mercado Bitcoin Halts Withdrawals After Estimated $46M Stolen

Brazil’s Top Crypto Exchange Attacked

On Monday, Mercado Bitcoin—Brazil’s largest crypto exchange—shared word of a security breach on social media, just days after top global exchange Binance was hit with a record-setting $6.3 billion attack.

“We identified and swiftly contained a security incident in one of our systems early this morning,” Mercado Bitcoin wrote on X. “We reiterate that: There was no harm to customers; there was no data breach.”

“As a precautionary measure for protection, deposits and withdrawals are temporarily suspended,” it said. “Our teams are mobilized investigating the case, tracking the assets, and coordinating measures with the competent authorities.”

The statement followed reports of suspicious transfers from the exchange, which appear to have been the exchange’s own assets rather than customer funds.

Per a report from local crypto outlet BitNoticias, security firm Hypernative sent out an alert estimating the total damages near $40 million worth of cryptocurrency across numerous chains, including Bitcoin, Ethereum, Solana, Tron, and beyond. That haul reportedly includes about $8.2 million worth of bitcoin, nearly $6.5 million in ether, $1 million in solana, and smaller amounts of hundreds of other tokens. In a follow-up X post, Mercado Bitcoin shared destination wallet addresses that it said held stolen funds.

Arkham Intelligence analyst Emmett Gallic shared around 11 a.m. ET that he had tracked more than $46 million in losses so far. “Lots of old deposit addresses are being swept by the hacker currently, while they sell off meme coins and altcoins,” Gallic wrote.

Tether CEO Paolo Ardoino wrote on X that his firm, the world’s largest stablecoin issuer, “froze more than 4.5M USDT related to this security incident.”

Crypto Attacks Continue

Mercado Bitcoin’s incident comes just days after Binance, the world’s largest crypto exchange by trading volume, was hit with a complex heist that saw $6.3 billion worth of assets pulled from the platform’s wallets. Roughly $3 billion of that total was frozen by stablecoin issuers and other centralized exchanges, and the firm said that it is using its own funds to replenish the remaining funds.

Customers suffered no losses from the record Binance attack, which replaced last year’s $1.5 billion Bybit heist as the worst crypto heist of all time. Both the Binance and Bybit attacks have been blamed on North Korean state-sponsored hacking groups, according to statements from U.S. authorities. Binance initially pegged the attack on a compromised engineer’s laptop, but later noted that the firm discovered “additional points of breach.”

Earlier last Thursday, prediction market platform Polymarket disclosed its own exploit that reportedly swiped $2.7 million from users. Trading was briefly halted while the platform investigated and contained the exploit, which it attributed to a third-party partner, and Polymarket said it would make any affected users whole.