Mercado Bitcoin (MB), Brazil's largest cryptocurrency exchange, confirmed a security incident that prompted the temporary suspension of deposits and withdrawals. The exchange stated that the breach was identified and contained overnight, and emphasized that no client funds or data were lost.
Incident details
Blockchain security firm Hypernative reported more than $40 million in suspicious outflows from wallets associated with Mercado Bitcoin. The transfers involved at least ten different blockchains, including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain, and Stellar.
Timeline and investigation
The first unusual movements were observed around 11 p.m. local time on Sunday. According to Hypernative, the funds were sent to newly created addresses linked to the suspected attacker. The transfers were ordinary cryptocurrency transactions signed as if authorized by the source wallets, but the method by which the attacker obtained signing capability remains unclear.
Mercado Bitcoin's statement indicated that its teams are investigating the incident, tracing the assets, and coordinating with authorities. No timeline has been provided for the resumption of normal deposit and withdrawal services.
Open questions
Key uncertainties include the exact origin of the breach, the definitive amount lost, and whether the moved assets belonged to clients or the exchange itself. The exchange has pledged to provide regular updates as the investigation progresses.
