Mercado Bitcoin Incident Puts About $49 Million in Assets at Risk Across 17 Chains
Key Facts
Mercado Bitcoin announced on November 2 that a security incident had affected the hot wallets used for daily operations, and temporarily halted the platform after discovering it. Chainalysis estimated that about $49 million moved during the attack across 17 blockchain networks, while Bitquery analysis estimated the value of outflows at about $48.6 million across 11 networks. These are estimates by independent analytics firms, while the company said it had ensured customers would not lose their assets. The platform said it notified the relevant authorities and activated governance protocols immediately after discovering the incident. In its update, it said, "The security incident affected only the hot wallets."
In its November 2 update, Mercado Bitcoin said it had blocked about $11 million in assets, while about $38 million remained unblocked at the time. The company said these figures represented the status of the assets when the update was issued, not the final amount that could later be frozen or recovered. Chainalysis provided a separate estimate of $49 million in stolen funds and said its work helped freeze $9 million in the hours after the incident. Bitquery said stablecoin issuers had frozen $11.8 million, according to its analysis published on November 5. The figures vary by source and estimate timing, while Mercado Bitcoin announced it would replenish the affected assets using its own resources.
CoinDesk cited a security report saying addresses linked to the attacker held about 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and 77,000 AVAX, in addition to more than 200 other tokens. These are amounts the report observed in addresses linked to the attacker, not figures the platform confirmed as the final tally of stolen assets. According to Bitquery, the attacker gained access to operational wallets and customer deposit addresses, while the company said customers would not bear losses. Mercado Bitcoin said it had begun replenishing the affected assets and that more than 33% of the transferred assets had been blocked. The company said the portion not yet recovered represented about 3% of its total assets under custody.
CoinDesk reported that the transfers were direct transactions, not a smart contract exploit, and that how the attacker obtained signing authority remained unknown. This means published coverage did not specify how the signing authority that enabled the transfers was exercised. On November 4, Mercado Bitcoin said it would use company funds to repurchase the affected assets, and that more than $15 million of the stolen funds had been frozen with help from industry participants. It added that its trading desk was preparing to carry out the necessary purchases in domestic and international markets. The announcement did not set a date for withdrawals to resume, despite the later start of steps to restore account access.
On November 9, the platform began reopening accounts in stages for viewing only, without announcing a date for withdrawals to resume. A spokesperson said account access would begin at 19:00 UTC, with all accounts expected to be viewable by 21:00. Customers could view their balances as they stood on November 2, the day of the incident. Cointelegraph coverage confirmed that a date for withdrawals to resume had not been announced when account access began. Viewing balances therefore remained separate from restoring the ability to withdraw funds.
Chainalysis said it would continue tracking the remaining funds, monitoring their movements and looking for further opportunities to intervene. This followed its statement that its work helped freeze $9 million in the hours after the incident. Bitquery, meanwhile, cited $11.8 million frozen, according to an update to its analysis published on November 5. The figures from the three parties reflect different stages and estimates of the response, with differences in the range of networks each tracked. The November 9 account-reopening update did not give a date for withdrawals to resume.