Mercado Bitcoin, one of Brazil’s largest cryptocurrency exchanges, confirmed a security incident in which more than $46 million in digital assets was drained from wallets on Monday. Although the exchange announced a temporary suspension of deposits and withdrawals, addresses associated with the breach continued to move funds for several hours.
Security firms said the attack involved standard transfers rather than a smart contract exploit. Dickson Wu, a senior security engineer at CertiK, published an initial analysis indicating that the attackers targeted eight smaller chains over four hours, including Base, Optimism and Arbitrum, before moving to Mercado Bitcoin’s main hot wallets.
The attackers then transferred small amounts of Ether from 27,160 addresses. Wu warned that the activity could potentially allow the attackers to move funds from Mercado Bitcoin customer deposit addresses as well.
According to Wu, funds continued leaving addresses linked to the breach after the exchange announced its suspension. Thousands of small Ether transfers were subsequently sent to a single address.
A Mercado Bitcoin spokesperson told Cointelegraph that customers had not suffered losses and that no data had been leaked. The company did not comment on the continued transfers. A data breach could also create notification obligations to Brazil’s data protection authority.
The incident has not been attributed to an organized group and remains under investigation. By 16:42 UTC, stablecoin issuers Tether and Circle had frozen approximately $6.2 million. Around $20 million had been moved into newly created wallets, while more than $20 million remained in addresses associated with the breach, including all 106 Bitcoin identified by Mercado Bitcoin.
Sources: Cointelegraph.