Mercado Bitcoin Hack Drains $46M as Wallet Transfers Continue
The Mercado Bitcoin breach raises a harder operational question than the headline loss: how much control did attackers retain over funds after the exchange paused deposits and withdrawals? More than $46 million in cryptocurrency was drained on Monday, while transfers tied to the incident continued for hours after the suspension was announced. That gap between a public pause and activity at associated wallets matters because a service notice describes what customers can do, while wallet movements can show what systems or credentials remain accessible. The two don’t necessarily change at the same moment.
Transfers reached customer deposit addresses
Certik senior security engineer Dickson Wu described an attack that began across eight smaller chains, including Base, Optimism and Arbitrum, over four hours. The attackers then moved to Mercado Bitcoin’s main hot wallets and sent small amounts of Ether from 27,160 addresses. That sequence suggests activity across more than one part of the exchange’s wallet setup, though the available details don’t establish how the attackers obtained access or which controls failed.
“So whoever did this can also move money out of MB’s customer deposit addresses,” Wu wrote in an initial post-mortem. He also reported continued outflows from addresses linked to the breach after the exchange announced its temporary suspension, followed by thousands of small ETH transfers into one address. The timing deserves close attention: suspending deposits and withdrawals can limit customer activity, but it doesn’t by itself explain whether internal wallet operations have stopped or whether attackers still have a path to move funds.
Security firms said the funds moved through standard transfers, rather than a smart contract exploit. That pattern makes the reported access to customer deposit addresses particularly significant: the incident appears to have involved wallet access across multiple parts of the exchange’s infrastructure. A smart contract exploit would point investigators toward code and transaction logic; ordinary transfers shift attention toward access, authorization and the handling of wallet credentials. The distinction narrows the kind of questions the exchange needs to answer, but it doesn’t identify the weakness.
This is more significant than it looks. Customer deposit addresses can sit at the edge of an exchange’s custody system, where funds arrive before they’re managed elsewhere. If an attacker can move assets from those addresses, the investigation has to establish how that access relates to the exchange’s hot wallets and the controls meant to separate different functions. The reported transfers raise that question; they don’t, on their own, reveal the answer.
Funds remain split across several destinations
By 4:42 pm UTC, stablecoin issuers Tether and Circle had frozen about $6.2 million. Roughly $20 million had moved into newly created wallets, while more than $20 million remained in addresses Mercado Bitcoin had identified, including all 106 BTC. Those figures describe funds at a particular point in the response, not a final accounting. The destinations matter because assets held in identified addresses may be easier to track, while funds moved elsewhere can complicate efforts to determine who controls them.
Freezing stablecoins can limit movement of those assets, but it doesn’t recover cryptocurrency held in other forms or establish how much of the reported loss can be returned. The split also means that “tracked” and “recovered” aren’t interchangeable descriptions. Here’s the thing: a visible trail is useful to investigators, but customers and the exchange still need a clear account of what remains accessible, what has been frozen and what may have left the identified addresses.
A Mercado Bitcoin spokesperson told Cointelegraph that customers had suffered no losses and that no data had been leaked. The company did not respond to questions about the continued transfers. The breach has not been attributed to a group, and the investigation is ongoing. That leaves a gap between the company’s assurance about customer impact and the reported evidence of movement after the suspension. The assurance may prove accurate, but a detailed accounting will matter more than the statement alone.
And this is the part most people overlook: an exchange can pause customer-facing services while the technical state of its wallets remains a separate question. The public announcement is a step in incident response, not proof that every route for moving assets has been closed. If you're working in this space, the distinction is a useful reminder that operational status and custody status need to be explained separately.
A fresh test for exchange security
Mercado Bitcoin, one of Brazil’s largest crypto exchanges, reported 4.5 million users as of July. That month, Tether announced a $20 million investment in the company to support expansion in tokenization, payments and credit. Those details place the breach against a backdrop of a business seeking to serve a large customer base and develop services beyond trading. They don’t explain the incident, but they raise the stakes of a clear response: users need to understand how assets are held and what happens when an exchange has to restrict access.
The breach follows the September closure of Chilean exchange Orionx, which is also backed by Tether. A forensic audit found that more than $7 million in customer assets had moved to wallets outside Orionx’s control. The cases differ, but both put custody controls and the traceability of customer funds under scrutiny across Latin American exchanges. The comparison should be handled carefully: the Orionx finding came from a forensic audit, while Mercado Bitcoin’s investigation is still ongoing. What the cases share is a basic concern about whether a company can account for customer assets when control of wallets is in question.
The incident also comes days after Binance reported a $6.3 billion hot wallet hack on Thursday. Binance suspended deposits and withdrawals, pledged to cover customer losses and began restoring withdrawals on Sunday, saying it had replenished 95% of the stolen assets. That response provides a point of comparison for the questions customers tend to ask after an exchange breach: whether withdrawals can resume, how losses will be handled and what evidence supports the company’s account. Mercado Bitcoin’s situation may differ in key ways, and the available information doesn’t establish a direct connection between the incidents.
For Mercado Bitcoin, the next concrete signal will be whether investigators can account for the funds and explain how transfers continued after trading operations were paused. The exchange says customers weren’t affected; the ongoing wallet activity makes that claim a key point to substantiate. A useful update would connect the timeline of the suspension to the timeline of transfers, then clarify what the exchange knows about the relevant addresses and the status of the assets. Until then, the figures offer a partial snapshot. A pause in service is visible; the extent of control over the wallets is the harder question.
