Mercado Bitcoin (BTC) Hack Losses Reach $46 Million and Still Climbing

Mercado Bitcoin Halts Deposits and Withdrawals

Brazil's largest cryptocurrency exchange, Mercado Bitcoin (BTC), suspended deposits and withdrawals on Monday after confirming a security incident in one of its systems overnight. On-chain trackers put the suspicious outflows above $40 million across multiple networks, while an analyst's running tally has passed $46 million and is still growing. The company says it identified and swiftly contained the breach, that no customer funds were lost and that no customer data, KYC records included, was exposed. The traced haul includes 106 Bitcoin (BTC), a modest slice of daily Bitcoin price turnover. The exchange gave no reopening timetable and has not named the breached system.

Hypernative Flags Outflows on 10 Blockchains

Blockchain security firm Hypernative flagged wallets tied to the exchange on at least 10 networks, including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain and Stellar. The first suspicious movements appeared around 11 PM Brazil time Sunday, and the largest outflows hit between 06:19 and 06:53 UTC, when most wallets sent their balances to freshly created addresses. The attacker's cluster now holds roughly 2,852 ETH, 106 Bitcoin (BTC), 10,700 SOL, 6.7 million XLM and 77,000 AVAX, plus more than 200 other tokens, a hoard large enough to rank the address set as a crypto whale. The transfers were ordinary signed transactions, not a smart contract exploit.

Arkham analyst Emmett Gallic reported losses above $46 million by mid-morning Eastern time, a figure that keeps rising because the attacker is sweeping old deposit addresses while selling memecoins and altcoins rather than HODLing them. The exchange has published the destination addresses tied to the incident on X, covering Bitcoin, Ethereum-compatible networks, Solana, Stellar and Tron, and says it shared them for identification and tracking purposes. Mercado Bitcoin is also coordinating with authorities and tracing assets. Its statement insists client balances were untouched, a distinction that matters because the moved funds appear to be exchange assets rather than customer holdings.

Tether Freezes 4.5 Million USDT

Tether moved fastest among issuers. CEO Paolo Ardoino said on X at 10:06 a.m. ET that the company had frozen more than 4.5 million USDT linked to the incident. That lever works only for tokens with a centralized issuer able to blacklist addresses; native assets such as Bitcoin (BTC) and ETH cannot be frozen the same way, so recovery on those chains depends on exchange coordination and legal process. Tether has a stake in the venue itself: it invested $20 million in Mercado Bitcoin in July, when the exchange said it served 4.5 million users. The frozen figure is not yet confirmed as final recovery data.

The Signing Access Question

The company has not said which system was breached, how much was taken or when services will reopen. Hypernative says it is still unclear how the attacker obtained signing capability, with open questions including possible private key exposure and failures in the infrastructure that authorizes transfers. Preliminary analysis found the movements did not exploit a smart contract flaw; they were ordinary transfers, signed as if approved by the source wallets themselves. The company has said it will absorb the entire loss. No attribution has been made, and no public evidence connects the breach to the Binance incident days earlier.

Days After the Binance Breach

The incident lands days after the largest crypto theft on record. On October 29, attackers reached $6.3 billion in assets at Binance after compromising an engineer's laptop and gaining access to internal systems used to process withdrawals, an attack the FBI attributes to North Korea's TraderTraitor group. By November 1, Binance had replaced 95 percent of the stolen assets and begun restoring withdrawals in phases. Tether reported about $1.57 billion in USDT frozen in that case, Circle said it had locked more than $800 million in USDC, and roughly $3.3 billion in stolen funds remain unaccounted for. Polymarket separately disclosed a $2.7 million exploit last Thursday and said it would fully compensate affected users.

Recovery Levers and Their Limits

The on-chain record frames the whole story: every flagged movement was a plainly signed transfer, so the question that decides the final loss is how signing authority was obtained, not which contract was exploited. The recovery levers so far are Tether's blacklist, the published destination addresses and the company's pledge to absorb the loss, but native BTC and ETH cannot be frozen, which keeps the traceable recovery pool small against the total taken. The episode also strengthens a long-running bitcoin maximalism critique of exchange-side multichain custody, where signing authority spread across ten chains multiplies the attack surface. The breach lands after a soft market stretch in which Bitcoin posted its second straight October loss with a 7.3% monthly decline. Opened at more than $40 million, the running tally now stands past $46 million, and it will keep moving until the sweep stops.