Brazil-based cryptocurrency exchange Mercado Bitcoin (MB) has temporarily suspended deposits and withdrawals after a security incident affecting one of its systems. In a statement, the exchange said it identified and contained the incident quickly, that clients had suffered no losses, and that no data had been leaked. MB has not given a timeline for restoring deposits and withdrawals.
Losses estimated at around USD 40 million
Blockchain security firm Hypernative estimated that wallets attributed to MB lost around USD 40 million. According to Hypernative, the movements involved wallets on at least ten blockchains, including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain, and Stellar. The earliest suspicious transfers appeared at around 11 pm Brazil time, with most funds sent to newly created addresses linked to the suspected attacker.
Hypernative said the transfers were ordinary cryptocurrency transactions signed as if authorised by the source wallets, rather than exploits of smart contract flaws. The firm said it remains unclear how the attacker obtained the ability to sign these transactions, with possible explanations including exposed private keys or failures in the infrastructure that authorises transfers. MB's statement does not directly link the incident to these wallet movements.
Asset tracing and next steps
MB said its teams are investigating the incident, tracing the assets, and coordinating with the relevant authorities. In a later update, the exchange said it had blocked USD 11.2 million in assets with support from industry companies and organisations, and it had shared the destination addresses to help monitor and trace activity across blockchain networks. The company has committed to providing regular updates.
Several questions remain open, including the origin of the incident, the final amount lost, whether the moved assets belonged to clients or to the exchange itself, and when normal operations will resume. Founded in 2013, MB operates one of Brazil's main crypto trading platforms. MB has also reminded customers that it never asks for passwords, verification codes, or recovery phrases. The incident follows a separate security incident at Binance in late October 2026.
