Mercado Bitcoin Assures Users Won’t Lose Funds Following $38M Security Breach

The exchange says services will resume only when full security conditions are met.

Mercado Bitcoin has assured customers they won’t lose any funds after the security incident that led it to suspend deposits and withdrawals on Monday.

The Brazilian crypto exchange has now put the value of the assets involved at around $38 million. Meanwhile, it had already blocked $11 million in coordination with Tether, Circle, Paxos, BRL1, and Chainalysis.

Recovery Efforts Continue

In its latest update, Mercado Bitcoin said other amounts eligible for blocking have also been identified, and containment efforts are continuing. The statement comes after an incident identified in one of the company’s systems during the early hours of Monday. The exchange temporarily suspended access to services as a preventive measure to protect customer assets. It said services would resume once full security conditions were in place.

The initial scale of the incident was reported by blockchain security firm Hypernative, which said more than $40 million had moved out of wallets tied to Mercado Bitcoin overnight. The firm’s preliminary estimate covered transfers across at least 10 blockchains, including Bitcoin, Ethereum, Solana and Tron. The exchange had previously said no customer data had leaked.

The first suspicious transfer was recorded at 2:15 UTC, while the largest movements took place between 6:19 and 6:53 UTC, when wallets linked to the exchange sent funds to newly created addresses. The transactions appeared to be ordinary signed transfers, meaning they were sent as though the source wallets had authorized them. Hypernative said it was still unclear how the attacker obtained the ability to sign those transactions.

More Exploits

The industry has had little breathing room, especially after the reported $6.3 billion Binance hack.

Meanwhile, ZachXBT flagged a separate suspected theft involving more than $133 million in withdrawals from centralized exchanges linked to an unnamed EU entity. The blockchain investigator identified an additional $27 million in withdrawals by the suspected illicit actor, which takes the total from the previously reported $106 million to more than $133 million.

You may also like:

The funds were withdrawn in USDC and USDT before the attacker began swapping USDC for ETH, routing transactions through instant exchanges such as WellWallet and Kyrrex, and converting funds into privacy-focused cryptocurrency XMR through Wagyu. The actor also bridged funds across multiple blockchains. ZachXBT said he was highly confident the activity was not linked to North Korea’s Lazarus Group, citing multiple laundering indicators.

He believes a large financial institution in Western Europe may have been exploited and suspects the incident is being covered up. ZachXBT also criticized the absence of a proper incident disclosure, while claiming that more than $30 million had already been laundered and could have been frozen by EU law enforcement.