On November 2, crooks moved assets out of the hot wallets of Mercado Bitcoin, Brazil’s oldest and largest crypto exchange, on ten blockchain networks at once. Estimates of the damage range from $30 million to $49 million. The exchange has suspended deposits and withdrawals and has not said when they will resume. On the morning of November 3, the platform was still down for maintenance.
Mercado Bitcoin has operated since 2013 and calls itself the country’s first crypto broker. Depending on the source, it has between 4.5 and 4.8 million customers. On October 27, the exchange applied for a license from the Central Bank of Brazil. In July, Tether became a minority shareholder in its holding company, 2TM.
How it unfolded
According to AuditKey, preparations began on November 1 at around 21:20 Moscow time. The first transfer went out at 04:36 on Arbitrum. Then, as CertiK analyst Dixon Wu describes it, the attacker spent about four hours testing small amounts on minor networks. The main withdrawal took roughly half an hour, from 09:19 to 09:53: hot wallets were emptied on ten networks, including Bitcoin, Ethereum, Solana, Stellar, Tron and Avalanche.
No smart contract vulnerabilities were involved. These were ordinary transfers signed with the exchange’s valid keys. How the attacker obtained signing rights is unknown. AuditKey stresses that the blockchain alone cannot tell an outside hack from an insider or a failure at a contractor.
“Contained,” while the withdrawals went on
At 15:56 Moscow time, Mercado Bitcoin announced that an incident in “one of its systems” had been detected and quickly contained, that customers would lose nothing and that no data had leaked. On the blockchain, something else was happening. By Bitquery’s count, from 15:27 to 19:56 the attacker emptied 36,042 customer deposit addresses on Ethereum and swept another 143 addresses on BNB Chain until 21:08. In other words, the draining continued for about four hours after the exchange’s statement.
The sum here is small, about $266,000: 91% of these addresses held less than $10. What matters more is that the attacker had keys not only to the hot wallets but also to the addresses customers use to fund their accounts. “Whoever did this can also withdraw from customer deposit addresses,” Wu says. Researchers interviewed by The Record dispute the exchange’s claim that customer funds were not affected. Technically, the exchange is right: it holds the coins on deposit addresses, and the customer has only a balance entry. But that is exactly why everything depends on whether it keeps its promise.
How much was taken: $30 million to $49 million
- AuditKey: $30.3 million, counting only tokens with a reliable price.
- Hypernative: more than $40 million on at least ten networks.
- Bitquery: $48.6 million, or $47.4 million excluding the EVA token.
- Chainalysis, which the exchange turned to for help: about $49 million across 17 networks. According to Bitquery, those 17 include networks where money moved from unrelated wallets, while the exchange’s own losses were on ten.
In its evening update, Mercado Bitcoin itself gave two figures: about $11 million blocked and about $38 million “not yet blocked.” Together that is roughly $49 million. Some outlets reported $38 million as the total loss. In fact, it is only the part that has not been frozen. According to Hypernative, the stolen assets include 106 BTC, 2,852 ETH, 10,700 SOL, 6.7 million XLM, 1.7 million TRX and more than two hundred other tokens. The bitcoins, according to Bitquery, have not moved yet.
Freezing: this time it helped
Tether made its first block at 13:21 Moscow time; Circle joined about six hours later. Bitquery counted $11.4 million in frozen funds: $5.9 million at Tether, $3.9 million at Circle, $1.5 million at Paxos and about $145,000 at Agora and Ripple. Another 358,000 EURC remained unfrozen. Chainalysis gives different figures: almost $10 million, more than $9 million of it at Tether. The two sets of numbers cannot be reconciled yet.
Here, freezing worked in the victims’ favor. But it is the same button: an issuer can stop USDT or USDC at any address, including yours, and the decision is the issuer’s alone. Nobody can freeze BTC, ETH, SOL or XLM, which is why the attacker calmly swapped most of the loot through the Mayan and Bridgers exchange services.
A promise without a source
The exchange keeps repeating that customers will lose nothing. Where the money will come from, and by when, it does not say: not a word about reserves, insurance or shareholders. Withdrawals will return “when it is safe.” As of the morning of November 3, Brazil’s Central Bank, its Securities Commission and the Federal Police had not commented publicly. The exchange separately warns about scammers offering to “help recover funds.” If you are a Mercado Bitcoin customer, do not respond to such offers and do not send anything to old deposit addresses until the exchange announces they are safe.
Open questions
- How did the attacker obtain signing rights: through the keys, the signing system, an employee or a contractor?
- Why did the exchange call the attack contained if withdrawals from customer addresses went on for another four hours?
- Have the deposit address keys been replaced, and can accounts be funded using the old details again?
- What money will the exchange use to cover the unfrozen $38 million?
- When, and in what order, will withdrawals resume?
- What is the final amount, and how many networks were affected: ten or seventeen?
What follows from this
A balance on an exchange is the exchange’s promise. While withdrawals are closed, your coins exist only as a row in its database, and you will get access back when it decides. Keep on an exchange what you trade, and the rest in a wallet whose keys only you hold. Bear in mind, though, that an issuer can freeze stablecoins even in your own wallet.
For context: three days earlier, Chainalysis — the very company now helping Mercado Bitcoin trace the stolen funds — disclosed a breach of its own systems.