Mercado Bitcoin Assures Customers of Fund Protection After Security Incident
Mercado Bitcoin has reassured its customers that their funds are secure following a security incident that prompted the suspension of deposits and withdrawals on Monday. The Brazilian cryptocurrency exchange has now placed the value of the affected assets at approximately $38 million. In collaboration with Tether, Circle, Paxos, BRL1, and Chainalysis, the exchange had previously frozen $11 million in assets.
Ongoing Containment Efforts
In its most recent update, Mercado Bitcoin stated that additional amounts eligible for blocking have been identified and that containment efforts are ongoing. This statement follows an incident detected in one of the company’s systems in the early hours of Monday. The exchange temporarily halted access to its services as a precautionary measure to safeguard customer assets, indicating that services would be reinstated once full security conditions were re-established.
Initial Incident Scale and Investigation
The initial scope of the incident was reported by blockchain security firm Hypernative, which noted that over $40 million had been moved from wallets associated with Mercado Bitcoin overnight. The firm’s preliminary estimate encompassed transfers across at least 10 blockchains, including Bitcoin, Ethereum, Solana, and Tron. The exchange had previously confirmed that no customer data had been compromised.
Transaction Analysis and Unclear Access Method
The first suspicious transfer was recorded at 2:15 UTC, with the most significant movements occurring between 6:19 and 6:53 UTC. During this period, wallets linked to the exchange transferred funds to newly created addresses. These transactions appeared to be standard signed transfers, suggesting they were authorized by the originating wallets. Hypernative indicated that it remains unclear how the perpetrator gained the ability to sign these transactions.
Broader Industry Concerns and Separate Allegations
The cryptocurrency industry has faced significant challenges recently, particularly following the reported $6.3 billion hack of Binance.
Meanwhile, blockchain investigator ZachXBT has highlighted a separate suspected theft involving over $133 million in withdrawals from centralized exchanges linked to an unnamed European Union entity. ZachXBT identified an additional $27 million in withdrawals by the suspected illicit actor, bringing the total from a previously reported $106 million to over $133 million.
The funds were initially withdrawn in USDC and USDT before the attacker began swapping USDC for ETH. Transactions were routed through instant exchanges such as WellWallet and Kyrrex, with funds ultimately converted into the privacy-focused cryptocurrency XMR via Wagyu. The actor also bridged funds across multiple blockchains. ZachXBT expressed high confidence that the activity was not connected to North Korea’s Lazarus Group, citing multiple indicators of money laundering.
ZachXBT suggested that a large financial institution in Western Europe may have been exploited and suspects the incident is being concealed. He also criticized the lack of a proper incident disclosure, claiming that over $30 million had already been laundered and could have been frozen by EU law enforcement.
