Mercado Bitcoin, Brazil's largest cryptocurrency exchange, has suspended deposits and withdrawals after a security incident that analysts estimate drained more than $40 million. The company says no customer lost money.

"We identified and swiftly contained a security incident in one of our systems early this morning," the exchange said in a statement on X, translated from Portuguese. It added that no customers were harmed and no data was breached, describing the suspension as a precautionary measure. Suspending transfers during an active investigation is a common containment step for exchanges, though it leaves customers temporarily unable to move funds until service resumes. The company said its teams are investigating the incident, tracking the assets, and coordinating with the authorities.

Who disclosed the $40 million in suspicious transfers?

Blockchain security firm Hypernative flagged more than $40 million in suspicious transfers across at least 10 blockchains, including Bitcoin, Ethereum, Solana, and Tron, according to a preliminary analysis reported by Decrypt. Mercado Bitcoin has not confirmed the figure, and it has not said which system was breached or how the attackers got in.

In a follow-up post, the exchange published destination addresses on five networks: Ethereum-compatible chains, Bitcoin, Solana, Stellar, and Tron. It said the addresses were shared only to help others identify and track the funds. Dispersing transfers across many chains makes tracing harder, which is part of why publicizing the destination addresses matters to exchanges and investigators watching for the funds' arrival.

Tether CEO Paolo Ardoino said in a post on X that the stablecoin issuer had frozen more than 4.5 million USDT linked to the incident. A freeze stops the tokens from moving, but it does not return them to their owner.

Timing and entry method remain unclear

Pablo Sabbatella, founder of security firm Opsek, relayed a report claiming that the largest outflows took place within roughly half an hour in the early hours of Monday, and that the transfers were plain transactions rather than a smart contract exploit. CoinDesk, which reported the analysis, noted that how the attacker gained signing access is unknown. None of these claims have been independently verified. Mercado Bitcoin has also not given a timeline for when deposits and withdrawals will resume.

A rough week for crypto exchanges

The incident comes days after hackers reached about $6.3 billion in assets at Binance, in what has been described as the largest crypto hack on record. The FBI attributed that attack to North Korea's TraderTraitor group.

Binance said the attackers gained access through an engineer's laptop, and it has since identified additional points of breach. The exchange says it has replaced 95% of the affected assets and begun restoring withdrawals in phases. Bitcoin Magazine reported that Tether froze about $1.57 billion in USDT and Circle froze more than $800 million in USDC in connection with that attack.

There is no public evidence linking the Mercado Bitcoin incident to the Binance attack, and Mercado Bitcoin has not named a suspect. Across both breaches, stablecoin issuer freezes have been an immediate part of the response, and the open questions in this case are whether Mercado Bitcoin confirms the $40 million estimate, identifies the entry point, and restores service.