Brazil’s Mercado Bitcoin halts transfers after $40M drained in ‘security incident’ - AMBCrypto

The Brazilian cryptocurrency exchange suspended all deposits and withdrawals after discovering a security breach in one of its systems. The company quickly responded by publishing destination wallet addresses across multiple blockchains to help trace the stolen assets, which were valued at approximately $46 million by blockchain analytics firm Arkham.

According to Arkham's analysis on November 2, the attacker's portfolio contained about $5.03 million in USDT, $3.02 million in USDC, $1.78 million in PEPE, $1.63 million in AAVE, and $1.46 million in PAX Gold, among other assets.

Exchange Response

Mercado Bitcoin claimed the incident occurred overnight and that customers were financially unaffected while no data was lost. The exchange stated it was investigating, tracking the funds, and coordinating with relevant authorities.

The company published addresses used on Bitcoin, Solana, Stellar, Tron, and Ethereum-based networks for tracing purposes. They are working to restore operations safely but haven't provided a timeline for resuming services or the total financial impact.

Tether Intervention

Tether CEO Paolo Ardoino announced that the company froze over 4.5 million USDT connected to the Mercado Bitcoin incident. This marks the second time in seven days that Tether has frozen funds following exploits, with the previous case involving Binance.

Tether's ability to block transfers of its tokens at specific addresses helps restrict movement during investigations. Ardoino didn't specify the next steps for the frozen tokens, including their possible return to Mercado Bitcoin.

Broader Security Concerns

The Mercado Bitcoin incident follows several other security breaches in the cryptocurrency space. Binance disclosed that attackers stole approximately $6.3 billion from its wallets on October 29, though the exchange has since begun reopening withdrawals and committed to covering the losses.

BTCPay Server also issued an advisory on November 2 after reports of Bitcoin and Litecoin thefts from wallets with spending keys stored on impacted servers. They identified that web servers from version 2.4.1 or less were targeted through a vulnerability patched in August but exploited through another method.

BTCPay recommends moving to fresh servers and transferring existing wallet seeds to new ones, as updating the affected software might leave security gaps. The company noted that wallets with spending keys held outside servers, like most hardware wallets, were unaffected.