Key Notes
- Mercado Bitcoin confirmed a security incident and temporarily suspended deposits and withdrawals.
- Tether CEO Paolo Ardoino says more than 4.5 million USDT linked to the incident was frozen.
- The reported $40 million-plus transfer estimate remains preliminary, while the exchange says clients suffered no losses.
Brazilian cryptocurrency exchange Mercado Bitcoin has suspended deposits and withdrawals after confirming a security incident in one of its systems. Blockchain security researchers cited by BitNotícias identified more than $40 million in suspicious transfers from wallets attributed to the platform.
The exchange’s November 2 official statement said the incident had been contained quickly, customers had suffered no losses and no data had leaked. It did not disclose a loss figure or explain the initial point of compromise.
Mercado Bitcoin’s official security incident statement.
Tether Freezes More Than 4.5 Million USDT
Tether CEO Paolo Ardoino said on X at approximately 15:06 UTC on November 2 that the company had frozen more than 4.5 million USDT linked to the incident. His post quotes Mercado Bitcoin’s original security announcement.
A freeze restricts the affected tokens; it does not establish that the funds have been returned to the exchange. Ardoino’s statement does not provide an address-by-address breakdown or revise the preliminary estimate of total losses.
Analysts Flag Transfers Across Multiple Chains
BitNotícias reported that Hypernative traced suspicious transfers to newly created addresses across Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain, Stellar and other networks.
The reported holdings included approximately 106 BTC, 2,852 ETH, 10,700 SOL, 1.7 million TRX, 6.7 million XLM and 77,000 AVAX, alongside more than 200 other tokens. These are preliminary investigative figures, rather than an audited statement of losses released by Mercado Bitcoin.
According to the report, the largest transfers occurred between 06:19 and 06:53 UTC on November 2, with earlier suspicious activity involving Bitcoin deposit addresses from around 02:15 UTC. Hypernative’s estimate remains dependent on confirming the ownership of the originating wallets.
Exchange Publishes Destination Addresses
In a follow-up update at approximately 14:24 UTC, Mercado Bitcoin published destination addresses for EVM networks, Bitcoin, Solana, Stellar and Tron. It said the addresses were being shared for identification and tracing while teams worked to restore operations safely.
That update provides an exchange-issued reference for monitoring the transfers. It does not independently reconcile every asset and source wallet to the reported $40 million-plus estimate. The company has not announced a reopening deadline in the statements reviewed.
Signing Access Remains an Open Question
The transactions described by BitNotícias were ordinary signed transfers. That leaves an important question unresolved: how an unauthorized actor could obtain the ability to initiate them. The public statements do not establish private-key theft, a specific software vulnerability or an attacker’s identity.
The incident follows the Binance breach and its subsequent withdrawal reopening. Similar operational pauses do not establish that the attacks share a perpetrator or entry point.
Separately, our EU theft report covers alleged withdrawals from customer accounts at several exchanges, a different claim from a compromise of an exchange’s own systems. No link between that case and Mercado Bitcoin has been established.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
