Mercado Bitcoin, one of Brazil's largest cryptocurrency exchanges, confirmed a security incident on Monday that blockchain analysts estimate drained more than $46 million from its wallets. Although the company announced it had suspended deposits and withdrawals, addresses linked to the incident continued to receive funds for hours afterward.

Dickson Wu, a senior security engineer at Certik, published an initial post-mortem of the incident on X, writing that the attackers "picked at eight small chains for four hours," including Base, Optimism and Arbitrum. The attack then shifted to the company's main hot wallets before siphoning tiny amounts of Ether (ETH) from 27,160 different addresses.

"So whoever did this can also move money out of MB's customer deposit addresses," Wu wrote.

According to security firms, the hack was carried out through standard transfers rather than a smart contract exploit. Mercado Bitcoin said the breach would have no financial impact on its customers. The distinction matters for recovery efforts: direct transfers leave a visible trail on public blockchains for investigators to follow, and stolen stablecoins can be frozen at the token level by their issuers.

Funds Kept Moving After Suspension Announcement

Wu reported that hours after Mercado Bitcoin announced the temporary suspension of deposits and withdrawals, funds continued to move out of addresses tied to the breach, followed by thousands of small ETH transfers funneled into a single address.

A Mercado Bitcoin spokesperson told Cointelegraph that customers had suffered no losses and that no data had been leaked. The company, however, did not respond to requests for comment on the continued transfers. A data breach of this kind could also trigger notification requirements under Brazil's data protection authority.

The hack has not yet been attributed to an organized group and remains under investigation.

Of the stolen funds, approximately $6.2 million had been frozen by stablecoin issuers Tether and Circle as of 4:42 pm UTC. Roughly $20 million had been moved into newly created wallets, while more than $20 million remained in associated addresses identified by Mercado Bitcoin, including all 106 BTC. Whether more of the outstanding funds can be frozen, and when the exchange lifts its temporary suspension, are the immediate points to watch as the investigation unfolds.

Exchange Joins Growing List of Breach Victims

Mercado Bitcoin reported 4.5 million users as of July, when stablecoin issuer Tether announced a $20 million investment to support the exchange's expansion into tokenization, payments and credit. Another Tether-backed exchange in Latin America, Chile's Orionx, announced its closure in September after a forensic audit found that more than $7 million in customer assets had moved to wallets outside its control.

The incident came days after Binance reported a $6.3 billion hack targeting its hot wallets on Thursday. Binance suspended deposits and withdrawals and pledged to cover customer losses, before beginning to resume withdrawals on Sunday, saying it had replenished 95% of the stolen assets. Taken together, the recent incidents show exchange hot wallets remaining a repeated point of attack, with operators responding through withdrawal pauses, pledges to absorb customer losses and, where stablecoins are involved, issuer freezes.