Mercado Bitcoin hack explained: how ~$40M left and what we know

Overnight into November 2, assets were drained from Mercado Bitcoin (MB), one of Brazil's largest crypto exchanges, across at least 10 blockchains. Security firm Hypernative's preliminary estimate puts the outflows at about $40M. The exchange confirmed a "security incident in one of our systems" and halted deposits and withdrawals. It says no customer funds were lost but has not given a figure.

What we know now

• Mercado Bitcoin says the incident was identified and contained, with no customer losses and no data leak. It has disclosed neither the amount nor the attack method.
• Deposits and withdrawals are suspended "as a preventive measure." No reopening date has been given.
• Hypernative's estimate, relayed by Wu Blockchain, puts suspicious transfers at more than $40M across at least 10 chains. The exchange has not confirmed it.
• Per Hypernative data cited by Livecoins, the attacker holds roughly 2,852 ETH, 106 BTC, 10,700 SOL, 6.7M XLM, 77,000 AVAX, 3.07M XDC, 1.7M TRX and more than 200 other tokens.
• On-chain, the funds have not yet reached exchanges or mixers: the ETH and BTC sit on fresh addresses. The attacker has not been identified.

How it happened

The exchange has shared no technical details beyond an incident "in one of our systems." In the Hypernative write-up quoted by Livecoins, the funds left through plain transfers rather than a smart-contract exploit. In other words, the attacker was able to sign transactions from the exchange's wallets. How that access was obtained (stolen keys, a compromised signing system, an insider) is not yet known.

Hypernative lists the affected networks as Ethereum, Bitcoin, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC and Stellar. A spread like that usually points to access to a shared hot-wallet management system rather than a single wallet. That is our inference, not a finding of the investigation.

Timeline

• Nov 1, 9:15 PM ET. The main wave of outflows from exchange wallets begins, per Hypernative (Livecoins). It is 11:15 PM Sunday in Brazil.
• Nov 2, 1:41 AM ET. A Bitcoin transaction consolidates 104.43 BTC from 34 inputs into address 19qGps…prDZp. Livecoins links to this address as the attacker's wallet. It now holds about 106.07 BTC.
• Nov 2, 3:32 AM ET. A 2,852.07 ETH transfer goes from 0x5cc7…d548 to 0xe485…2478. Livecoins cites this transaction as the attacker's ETH withdrawal.
• Nov 2, 7:07 AM ET. 2,800 ETH moves from 0xe485…2478 to a fresh address, 0x8419…F320, where it has stayed.
• Nov 2, 7:56 AM ET. Mercado Bitcoin posts an official statement: the incident was identified and contained, no customer losses or data leak, deposits and withdrawals paused, the exchange is working with the authorities and promises regular updates. The same minute, Brazilian outlet BitNotícias reports Hypernative's $40M estimate.
• Nov 2, 8:16⁠–⁠9:00 AM ET. Address 0xe485…2478 sends 200 ETH to another new address and spreads dozens of Ethereum tokens, including USDT, USDe and PAXG, across other addresses (per the Blockscout explorer).
• Nov 2, 8:57 AM ET. Wu Blockchain circulates Hypernative's estimate: more than $40M across at least 10 chains, attack method unknown.

Where the money went

As of our latest check, the stolen funds sit on new attacker addresses. There is no sign yet of them being sent to mixers, bridges or exchanges.

• Bitcoin: about 106.07 BTC on 19qGpsHvzh1t6pVi526XNNkh6hW6prDZp (mempool.space).
• Ethereum: 2,800 ETH sits on 0x8419e7824e785C4Ac8D9d94A0093C437AB1FF320, 200 ETH on 0xCeDFEd1392d75aEC08D630be787399E916791279, and about 406 ETH remains on 0xe485e7a70b1131216cb47ca4555c4bbb2c742478. That totals more than 2,852 ETH: the history of 0xe485…2478 shows other incoming transfers too.
• Other chains (Solana, Tron, Stellar, Avalanche, XDC and others) we have not yet checked on-chain. Figures for them come from Hypernative's estimate.

What the team and exchanges did

Mercado Bitcoin suspended deposits and withdrawals. Its statement says teams are investigating, tracing the assets and "coordinating measures with the competent authorities," without naming them. The exchange has not announced a bounty, and no freezes by other exchanges or stablecoin issuers (Tether, Circle) have been reported so far.

The incident came less than three days after the Binance hack, with exchange hot-wallet security already under scrutiny.

What it means for holders

MB customers currently cannot deposit or withdraw. The exchange says their balances are unaffected. The key open questions: when withdrawals reopen, whether the exchange discloses the amount and the attack vector, and whether any of the funds, stablecoins in particular, can be frozen. For the live bitcoin price, see the daily brief.

This is not investment advice.

This story is developing: we are tracking events and adding new information. Last updated Nov 2, 9:15 AM ET.