Brazil’s largest cryptocurrency exchange, Mercado Bitcoin, has suspended deposits and withdrawals after identifying a security incident that reportedly involved more than $40 million in suspicious transfers. The disruption was announced on November 2, as blockchain security firms began tracing transactions across multiple networks.
The exchange said it identified and quickly contained the incident in one of its systems. It described the suspension of deposits and withdrawals as a preventive measure while its teams investigate, track the affected assets and coordinate with authorities.
The reported financial impact has not been independently confirmed by Mercado Bitcoin. Blockchain security firm Hypernative flagged more than $40 million in suspicious transfers, while other security analysts have also reported substantial outflows. The exchange has not published an official loss figure.
Mercado Bitcoin said customers had suffered no financial losses and that there had been no data breach. Those assurances are significant for users concerned about the safety of their holdings, although the investigation has yet to establish publicly how the incident occurred or how much cryptocurrency was moved without authorization.
More Than $40 Million in Transfers Reported Across Multiple Blockchains
Initial security analysis indicates that the suspicious activity involved wallets connected to at least 10 blockchain networks. Reported networks include Ethereum, Bitcoin, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain and Stellar.
According to information shared by security researchers, a large portion of the transfers occurred within a short period on Monday morning. The transactions reportedly moved assets from wallets associated with the exchange to newly identified addresses.
The activity appears to have involved ordinary blockchain transactions rather than a smart contract exploit. However, investigators have not established how the attacker obtained the signing access required to authorize the transfers. That question will be central to understanding whether the incident involved compromised credentials, internal systems or another security weakness.
Mercado Bitcoin subsequently published destination wallet addresses across several networks to help other parties identify and monitor the movement of funds. The exchange said it was sharing the information for tracking purposes as its investigation continued.
Tether also reported taking action connected to the incident. Chief executive Paolo Ardoino said the stablecoin issuer had frozen more than 4.5 million USDT linked to the security breach. Freezing tokens can prevent their movement from identified addresses, although it does not automatically mean the funds have been recovered or returned.
Withdrawal Suspension Raises Questions About Exchange Security
For customers, the immediate concern is access to their cryptocurrency. With deposits and withdrawals suspended, users cannot freely move assets into or out of Mercado Bitcoin while the exchange works through the incident. The company has not provided a confirmed timetable for restoring these services.
The incident also comes shortly after Binance suffered a separate major security breach. That attack resulted in billions of dollars in reported losses and prompted temporary withdrawal restrictions. However, there is currently no public evidence linking the Mercado Bitcoin incident to the Binance attack, and the two investigations should be treated separately.
The latest incident highlights the operational risks facing centralized cryptocurrency exchanges, particularly when large amounts of customer-related assets are managed through connected systems and blockchain networks. Even when an exchange says customer balances remain unaffected, a security incident can disrupt access and raise questions about custody controls.
Mercado Bitcoin’s next updates will be important in establishing the scale of the incident, how the unauthorized transfers occurred and when normal deposit and withdrawal services can resume. For now, the reported $40 million figure remains an estimate from security monitoring firms rather than a confirmed loss disclosed by the exchange.
About The Author
