Mercado Bitcoin, one of Brazil’s largest Bitcoin exchange, has confirmed a security incident that saw over $46 million worth of cryptocurrency drained from wallets on Monday. Despite the company’s announcement that deposits and withdrawals had been suspended, addresses associated with the incident continued to receive funds for hours afterward.
Security firms have stated the hack was carried out through standard transfers, rather than a smart contract exploit.
Senior security engineer at Certik, Dickson Wu published an initial post mortem of the incident, stating that the attackers “picked at eight small chains for four hours,” including Base, Optimism and Arbitrum. The attack then moved to the company’s main hot wallets before transferring tiny amounts of Ether (ETH) from 27,160 different addresses.
“So whoever did this can also move money out of MB’s customer deposit addresses,” he wrote.
Funds move despite suspension
Hours after Mercado Bitcoin announced a temporary suspension of deposits and withdrawals, funds continued to move out of addresses tied to the breach, followed by thousands of small ETH transfers into a single address.
A spokesperson for Mercado Bitcoin told Cointelegraph that customers had suffered no losses and no data had been leaked, but the company did not respond to requests for comment on the continued transfers. A data breach could also trigger notification requirements to Brazil’s data protection authority.
The hack has not yet been attributed to an organized group and remains under investigation.
Of the stolen funds, by 16:42 UTC approximately $6.2 million had been frozen by stablecoin issuers Tether and Circle. About $20 million had been transferred into newly created wallets, while over $20 million remained in associated addresses identified by Mercado Bitcoin, including all 106 BTC.
Mercado Bitcoin joins breach list
Mercado Bitcoin had 4.5 million users as of July, when stablecoin issuer Tether announced a $20 million investment to support its expansion in tokenization, payments and credit. Another Tether-backed exchange in Latin America, Chile’s Orionx, announced its closure in September after a forensic audit found that more than $7 million in customer assets had moved to wallets outside its control.
The incident comes days after Binance reported a $6.3 billion hack targeting its hot wallets on Thursday. The exchange suspended deposits and withdrawals and pledged to cover customer losses. Binance began resuming withdrawals on Sunday, saying it had replenished 95% of the stolen assets.