Mercado Bitcoin to restore account access Monday after $46M hack

Brazilian crypto exchange Mercado Bitcoin said it will start restoring customer account access on Monday, a week after hackers pulled funds out of its hot wallets and customer deposit addresses. In a statement to Cointelegraph, published Nov. 4, the exchange said customers would first regain access through its website to view balances, statements, holdings and investments. Transfers, withdrawals and trading will resume in later phases, subject to independent security testing.

The exchange also pledged to use company funds to replenish assets affected by the breach and said more than $15 million in stolen funds had already been frozen with help from the industry. "Our trading desk is preparing to begin the necessary repurchases in domestic and international markets," it said. Mercado Bitcoin added that its cash position is strong, bolstered by a $20 million investment from stablecoin issuer Tether that was announced in July.

The update follows the company's disclosure on Monday, Nov. 2, that it had suspended deposits and withdrawals after identifying a security incident in one of its systems early that morning. "We identified and quickly contained a security incident in one of our systems early this morning," the exchange said in a Portuguese-language post on X. "As a preventive protection measure, deposits and withdrawals are temporarily suspended." The company said no customer lost money and no data leaked.

Blockchain security firm Hypernative flagged more than $40 million in suspicious transfers across at least 10 blockchains, including Bitcoin, Ethereum, Solana and Tron, in a preliminary analysis. Mercado Bitcoin has not confirmed that figure and has not disclosed how the attackers got in, Decrypt reported. In a follow-up post the exchange published destination addresses it identified on five networks: EVM chains, Bitcoin, Solana, Stellar and Tron, saying the addresses were released only so others could identify and track the funds onchain.

Certik senior security engineer Dickson Wu published an initial post-mortem of the incident saying the attackers "picked at eight small chains for four hours," including Base, Optimism and Arbitrum, before moving on to the company's main hot wallets. Wu wrote that whoever carried out the attack can also move money out of Mercado Bitcoin's customer deposit addresses, and that the intrusion then pushed tiny amounts of Ether from 27,160 different addresses, according to Cointelegraph. Blockchain analysts estimated the theft at more than $46 million.

Security firms have said the hack was carried out through standard transfers rather than a smart contract exploit. Hours after Mercado Bitcoin announced the suspension, funds continued to move out of addresses tied to the breach, followed by thousands of small Ether transfers into a single address. A spokesperson for the exchange told Cointelegraph that customers had suffered no losses and no data had been leaked, but the company did not respond to questions about the continued transfers. The report noted that a data breach could also trigger notification requirements to Brazil's data protection authority. The hack has not been attributed to an organized group and remains under investigation. Mercado Bitcoin has not linked the incident to the theft days earlier from Binance, and has not said who is behind its own.

By 4:42 p.m. UTC on Nov. 2, about $6.2 million had been frozen by stablecoin issuers Tether and Circle. Roughly $20 million had been moved into newly created wallets, while more than $20 million remained in associated addresses identified by Mercado Bitcoin, including all 106 BTC, the report said. Tether chief executive Paolo Ardoino wrote on X that the issuer had frozen more than 4.5 million USDT connected to the incident. A freeze prevents the tokens from being moved but does not by itself return the funds to their owner.

Mercado Bitcoin had 4.5 million users as of July, when Tether announced the $20 million investment to support its expansion in tokenization, payments and credit. The exchange has said it will post regular updates on X while the phased reopening proceeds.