Mercado Bitcoin $40M Hack Halts Withdrawals — Is Brazil Next to Tighten Rules?

Forty million dollars, ten blockchains, about half an hour. That is how fast wallets tied to Brazil's biggest crypto exchange, Mercado Bitcoin, were drained early on Monday, and by the time most traders woke up, deposits and withdrawals were shut. The exchange says no customer lost money, but it has not said how the attacker got signing access, and it has not given a date to reopen, so for now, anyone with coins sitting there can only wait and watch the wallets.

Key points:

• Mercado Bitcoin stopped deposits and withdrawals on Monday after a security incident in the early hours, and it says customers lost nothing and no data leaked.
• Security firms put the drain at more than $40 million across at least 10 chains, from Bitcoin and Ethereum to Solana, Tron and Stellar, though the exchange itself has not confirmed that number.
• Tether has already frozen more than $4.5 million in USDT tied to the incident, while the rest of the coins sit in fresh wallets that the exchange has now published for tracking.

On Monday, security firm Opsek's founder relayed a report that put the biggest outflows between 06:19 and 06:53 UTC. In that short window, wallets on Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain, Stellar and other chains sent most of their funds to fresh addresses. The speed is part of the story here. This was not a slow leak over days that someone might have spotted and stopped. It was a quick sweep, done before most of the market was even awake in Brazil.

The haul, as reported so far, was spread wide rather than stacked in one coin. The attacker now holds about 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and 77,000 AVAX, plus more than 200 other tokens, according to the report CoinDesk cited. That mix matters, because it tells traders this was not a single hot wallet on a single chain. Whoever did it had signing access across a whole set of wallets, and they used plain transfers, not a smart contract trick, to move the money out.

Read also: BTCPay Wallets Drained on Old Versions — Is Your Server Next?

Mercado Bitcoin's own statement, posted in Portuguese on X, was short. It said the team had found and quickly contained a security incident in one of its systems in the early hours of the morning. It stressed two points: no harm to customers, and no data breach. As a safety step, deposits and withdrawals were paused while the team looks into what happened, tracks the assets and works with the authorities. In a follow-up post, the exchange published the destination addresses it had found on EVM chains, Bitcoin, Solana, Stellar and Tron, so other exchanges and trackers can spot the funds if they move again.

That tracking step is where Tether comes in. Tether chief Paolo Ardoino said the stablecoin issuer has frozen more than $4.5 million in USDT tied to the incident. A freeze like that works because Tether can blacklist an address, which stops those tokens from moving on. It does not, on its own, hand the money back to its owner. It just parks that slice of the haul where the attacker cannot spend it, and it gives investigators a fixed target to work from while the rest of the coins keep moving through fresh wallets.

What do Brazilian traders do while withdrawals stay shut?

The timing makes this hit land harder than the $40 million figure alone suggests. It comes just days after hackers drained more than $6 billion from Binance on October 29, a theft the FBI has blamed on North Korea's TraderTraitor group. Binance has since reopened withdrawals in phases and said it has replenished about 95% of the affected assets. Mercado Bitcoin has not linked the two incidents, and it has not named who is behind its own. CoinDesk was clear on that point: there is no public evidence tying the Brazil incident to the Binance attack, and traders should not lump them together just because they happened in the same week.

Still, the mood after two exchange incidents in a few days is easy to read. Traders who keep coins on an exchange for quick trades are now asking a plain question: how fast can I get my money out if something goes wrong? For Mercado Bitcoin users, that question has no answer yet, because the exchange has not set a reopen date. It has said only that it will post regular updates on X. Until withdrawals come back, local traders who use the platform as their main way in and out of crypto in reais are stuck in place, unable to move coins to a wallet they control or to another exchange, even if prices move sharply while they wait.

There is also a gap traders should keep in mind. The $40 million number comes from security firms, not from Mercado Bitcoin itself. The exchange has not confirmed it, and it has not said how the attacker got signing access. That means the true size of the loss could shift as more wallets are traced, and the cause could turn out to be very different from what early reports suggest. A plain transfer, with no smart contract exploit, points toward access to keys or signing systems, but that is still a guess until the exchange says more. Anyone trading on this news should treat the early numbers as a first sketch, not a final tally.

My own read is plain: a halt with no reopen date hurts trust more than the dollar figure does, because traders can live with a bad day, but not with a locked door. If Mercado Bitcoin reopens fast, with a clear account of what broke and what changed, this fades into a bad week for one exchange. If the halt drags on, or if the next update raises more questions than it answers, users will start moving coins the moment the doors open, and that exit, not the hack itself, is what could leave a lasting mark on Brazil's biggest exchange.

Until then, the safe move is the boring one: do not park more on any exchange than you need for trades you plan to make right away, and keep the rest where you hold the keys. Watch for three things next: a reopen date from Mercado Bitcoin, a confirmed loss figure from the exchange itself, and any move of the published wallets toward an exchange that can freeze them. If those wallets start moving in bulk, expect a fresh round of freezes and warnings, and expect other exchanges to tighten their own checks in response.

Read also: Binance Users Pull $3.64B After Withdrawals Reopen — Is the Rush Over?

— BitByLine News Desk

This post is news only, not financial advice. BitByLine never tells anyone to buy or sell crypto. What you do with your own money is your own call, and the risk is yours too, so do your own research first. Read our full Disclaimer.

Sources: CoinDesk, Decrypt