Mercado Bitcoin, a major Brazilian cryptocurrency exchange, suspended deposits and withdrawals on Monday after identifying a security incident in one of its systems. The platform stated that the issue was detected and contained early in the morning, with no losses suffered by customers and no leakage of customer data.

Security firm Hypernative reported more than $40 million in suspicious transfers originating from wallets linked to the exchange. These movements occurred across at least 10 blockchains, including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain and Stellar. The exchange has not publicly confirmed the $40 million figure as its actual loss.

Timeline of Suspicious Transfers

According to Hypernative analysis, the first suspicious activity began around 02:15 UTC. The bulk of the outflows took place in a concentrated 34-minute period between 06:19 and 06:53 UTC. During this window, wallets associated with Mercado Bitcoin directed funds to newly created addresses.

Researchers characterized the transfers as ordinary signed transactions rather than exploits of smart contracts. This indicates the attacker obtained the ability to authorize movements from the affected wallets, though the precise method of compromise remains unclear. Hypernative described its $40 million estimate as preliminary pending full verification that all source addresses belong to the exchange.

Preliminary figures cited by researchers included approximately 2,852 ETH, 106 BTC, 10,700 SOL and 6.7 million XLM, along with more than 200 other tokens. On the Bitcoin network, roughly 106 BTC moved to a destination address, with the largest single transfer of 104.4 BTC occurring at 06:41 UTC. As of later that day, those Bitcoin funds had not been moved further.

Exchange Response and Asset Tracking

In its official statement, Mercado Bitcoin confirmed the security incident and outlined its immediate actions.

The company later published five destination addresses connected to the incident, spanning EVM-compatible networks, Bitcoin, Solana, Stellar and Tron. It released the addresses to assist in public tracking of the funds on blockchain explorers.

Tether responded by blacklisting two of the attacker-linked addresses on its Ethereum and Tron networks, freezing the USDT held in them. On-chain data showed the Tron address containing 708,243 USDT and the Ethereum address holding more than 3 million USDT.

Ongoing Investigation

Mercado Bitcoin has not disclosed which specific system was affected or announced a timeline for restoring full deposit and withdrawal services. The company continues to investigate the incident while working with authorities to recover or freeze the moved assets. Security researchers continue monitoring the destination addresses for any further activity.

The event involves unauthorized transfers from exchange-linked wallets and has prompted heightened scrutiny of internal access controls at cryptocurrency platforms. No additional details on the attack vector have been confirmed by the exchange or independent analysts at this stage.