Brazil's largest cryptocurrency exchange kept deposits and withdrawals suspended on Monday after a security incident in one of its systems, with preliminary estimates placing suspicious transfers above $40 million. The shutdown left customers unable to move funds into or out of the platform while the company worked to restore operations.

Mercado Bitcoin said in a statement posted to X that it had identified and contained the incident. The company said customers suffered no losses and that no data had leaked, describing the suspension as a precaution. Its teams are investigating, tracing assets and coordinating with authorities, the company said. According to Bloomberg, the company said it would absorb all losses, putting the financial burden of the incident on the company rather than its users.

The company has not said which system was breached, how much was taken or when services will reopen. Its current statements provided no total loss figure and no timetable — the disclosures to watch for as the investigation develops.

Mercado Bitcoin has since published destination addresses tied to transactions from the incident, spanning Bitcoin, Ethereum-compatible networks, Solana, Stellar and Tron. It said it shared the addresses for identification and tracking purposes, giving other platforms and analysts a common reference for spotting incident-linked funds.

Blockchain security firm Hypernative has put preliminary estimates of suspicious transfers above $40 million across several blockchains. The exchange has not confirmed that figure, so the final size of the loss remains unverified. Other analysts (Wu Blockchain, Emmett Gallic) are citing higher figures and note that the sweeping of funds remains ongoing.

Stablecoin issuer Tether has entered the response. Tether CEO Paolo Ardoino said on X at 10:06 a.m. ET that the company had frozen more than 4.5 million USDT linked to the incident, underscoring the capability stablecoin issuers have to freeze tokens once addresses are tied to an incident. Tether invested $20 million in Mercado Bitcoin in July, when it said the exchange served 4.5 million users, a user count that signals the scale of the platform affected by the halt.

A Rough Week for Mercado and Other Exchanges

The incident comes days after one of the largest crypto thefts in recent memory. On Oct. 29, attackers reached $6.3 billion in assets at Binance after compromising an engineer's laptop and gaining access to internal systems used to process withdrawals. Binance said it found no evidence that private keys were exposed. By Nov. 1, it had replaced 95 percent of the stolen assets and begun restoring withdrawals in phases.

On the law enforcement front, the FBI has attributed the attack to North Korea, and the U.S. Secret Service is working with Circle to trace and freeze funds. Tether reported about $1.57 billion in USDT frozen, and Circle said it had frozen more than $800 million in USDC in coordination with authorities.

Binance has said it found additional points of breach beyond the initial compromise, which it originally attributed to a single engineer's laptop, according to a company update posted to Binance Square. The exchange has not yet published a full post-mortem explaining how the attackers prepared and executed the operation, which some estimates suggest took at least 36 hours of groundwork.

The destination of roughly $3.3 billion in stolen funds that were not frozen has not been fully explained, and the exchange has not detailed what it expects to recover from that pool. Investigators continue to track wallet activity across ten blockchains.

This article is based on reporting first published on Bitcoin Magazine and written by Micah Zimmerman.