Brazilian exchange Mercado Bitcoin suffers over $40 million theft; deposits and withdrawals suspended

On Monday, November 2 local time, Brazilian crypto exchange Mercado Bitcoin announced the suspension of all deposit and withdrawal services. This move followed a large-scale theft from wallets associated with the platform—assets were drained across at least 10 blockchains, with multiple security firms estimating total losses exceeding $40 million. According to on-chain monitoring data shared by Pablo Sabbatella, founder of crypto security firm Opsek, the largest wave of fund outflows occurred between 06:19 and 06:53 UTC, impacting Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC, and Stellar, among others. The attacker currently controls approximately 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM, 77,000 AVAX, and over 200 other tokens. All transfers were executed as standard transactions—not exploiting any smart contract vulnerability—and the precise vector through which signing privileges were compromised remains unknown.

Mercado Bitcoin later issued a statement on X, stating it had “identified and swiftly contained” the security incident. The exchange emphasized that customer funds remain unaffected, no data breach occurred, and the suspension of deposits and withdrawals is purely precautionary. It added that the platform is actively collaborating with law enforcement to trace the stolen assets. To aid on-chain tracking, Mercado Bitcoin simultaneously published target addresses across multiple chains—including EVM-compatible networks, Bitcoin, Solana, Stellar, and Tron. Paolo Ardoino, co-founder of Tether, confirmed that roughly $4.5 million worth of USDT involved in the incident has been frozen. As of now, there is no publicly available on-chain or investigative evidence linking this incident to the earlier theft targeting Binance.