Mercado Bitcoin, one of Brazil's largest cryptocurrency exchanges, has suspended operations after a security breach involving approximately $38 million in digital assets, with $11.2 million already frozen as investigators trace suspicious transfers across multiple blockchains.

The incident took place on November 2, when attackers allegedly seized control of wallets associated with the exchange and moved substantial cryptocurrency holdings to newly created addresses. Mercado Bitcoin initially halted deposits and withdrawals before temporarily taking its platform offline, disclosing the incident in a statement on X.

The company maintained that customer assets remain protected and that no personal information was compromised, although independent blockchain researchers continued to flag suspicious transactions even after the exchange declared the incident contained.

Attack Spans at Least 10 Blockchains

The wallets involved operated across at least 10 networks, including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain and Stellar. Blockchain security firm Hypernative initially identified more than $40 million in suspicious transfers, with the largest movements concentrated in a roughly 34-minute window between 06:19 and 06:53 UTC. A burst of that scale spread across separate ledgers requires investigators to correlate activity chain by chain, one reason analytics firms are mapping overlapping portions of the outflows.

The transferred assets included approximately 106 BTC, 2,852 ETH, 10,700 SOL, 6.7 million XLM and 77,000 AVAX, alongside more than 200 other cryptocurrencies. The transactions appeared to consist of ordinary wallet transfers rather than a smart contract exploit, raising questions about how the attackers obtained authorization to move the funds. The distinction matters technically: unlike a smart contract exploit, which abuses flaws in on-chain code, an ordinary transfer can only be executed by whoever controls the relevant private keys or signing credentials, making the question of how signing authority was obtained central to the investigation.

Further analysis of the affected wallets, documented in an investigation by on-chain analytics platform Bitquery, estimated total outflows at $48.5 million and identified thousands of Ethereum deposit addresses being emptied after Mercado Bitcoin's initial containment announcement. The findings suggest the compromise may have extended beyond the exchange's primary hot wallets into infrastructure controlling individual customer deposit addresses. Exchanges typically generate a unique deposit address for each customer and rely on internet-connected hot wallets for day-to-day processing, so control of both layers would span far more of an exchange's fund flows than a single hot wallet compromise. The precise attack method and total financial impact remain under investigation.

Mercado Bitcoin subsequently placed the value of the assets involved at approximately $38 million while reporting progress in blocking funds connected to the incident. That figure and Bitquery's higher estimate have not yet been reconciled.

Tether and Other Issuers Help Freeze $11.2 Million

The exchange has coordinated with stablecoin issuers and blockchain intelligence companies to prevent further movement of the affected cryptocurrency. Tether CEO Paolo Ardoino confirmed on X that more than 4.5 million USDT linked to the incident had been frozen. Mercado Bitcoin later reported approximately $11.2 million in blocked assets through cooperation with partners including Tether, Circle, Paxos, BRL1 and Chainalysis, detailing the figure in a post on X.

The rising total reflects how issuer freezes operate: stablecoin issuers such as Tether, Circle and Paxos can blacklist specific addresses at the token-contract level, immediately blocking transfers of their tokens held there. Native assets such as Bitcoin and Ethereum have no comparable central control, so recovering them depends on tracing. Additional funds have been identified as potentially recoverable, although freezing cryptocurrency does not automatically return it to the exchange.

Mercado Bitcoin has notified Brazilian authorities and is continuing forensic investigations while preparing to restore normal services. The company has not announced a confirmed timetable for reopening.

Sector Context: Recent High-Profile Attacks

The breach came days after the record $6.3 billion Binance hack, which the FBI attributed to North Korea's TraderTraitor operation. Binance subsequently resumed withdrawals after replenishing most affected customer assets. On October 29, Polymarket suffered a $2.7 million wallet-draining attack involving a compromised third-party monitoring service. No evidence currently connects the Mercado Bitcoin incident to either attack, and the identity of its perpetrators remains unknown.

Customer Protections and Next Steps

Mercado Bitcoin has reiterated that customers will not bear losses resulting from the breach. It has also warned users against fraudulent reimbursement messages, emphasizing that legitimate support representatives will never request passwords, verification codes or wallet recovery phrases.

The exchange's immediate priorities remain recovering the affected assets, identifying the security failure and restoring operations without exposing customer funds to further risk. The confirmed reopening timetable, the forensic findings on how wallet authorization was obtained, and any increase to the $11.2 million frozen total are the key markers to watch as the response unfolds.