Mercado Bitcoin breach wallets kept moving funds after suspension, CertiK says
In brief
- Mercado Bitcoin paused deposits and withdrawals after a breach; Cointelegraph said over $46 million was drained.
- CertiK's Dickson Wu said funds kept leaving breach-linked addresses hours after the suspension.
- Tether and Circle had frozen about $6.2 million of the stolen funds by 16:42 UTC, Cointelegraph reported.
- A company spokesperson told Cointelegraph customers lost nothing and no data leaked.
What CertiK's post-mortem shows
Mercado Bitcoin confirmed the security incident. Security firms said it was carried out through standard transfers rather than a smart contract exploit, so this wasn't a bug in some defi contract.
CertiK senior security engineer Dickson Wu published an initial post-mortem saying the attackers spent four hours on eight small chains (Base, Optimism and Arbitrum among them) before moving on to the exchange's main hot wallets. Tiny amounts of ETH then went out from 27,160 different addresses, according to Wu.
The timing is what stands out. Wu said funds kept leaving breach-linked addresses hours after Mercado Bitcoin announced the temporary suspension, and thousands of small ETH transfers then flowed into a single address.
“So whoever did this can also move money out of MB’s customer deposit addresses,” he wrote.
Mercado Bitcoin didn't respond to requests for comment on the continued transfers.
Where the money went
By 16:42 UTC, stablecoin issuers Tether and Circle had frozen about $6.2 million of the stolen funds, Cointelegraph reported. Roughly $20 million had moved into newly created wallets. More than $20 million (including all 106 BTC) was still sitting in associated addresses that Mercado Bitcoin had identified.
Nobody's been named. The hack hasn't been attributed to an organized group, and it's still under investigation.
The company's position
A Mercado Bitcoin spokesperson told Cointelegraph that customers suffered no losses and that no data was leaked. That second point carries regulatory weight in Brazil, where a data breach could trigger notification requirements to the country's data protection authority.
The exchange had 4.5 million users as of July, when Tether announced a $20 million investment in it. It isn't the only Tether-backed exchange in Latin America to run into trouble, either. Chile's Orionx announced its closure in September after a forensic audit found more than $7 million in customer assets had moved to wallets outside its control.
Frequently asked questions
How was the Mercado Bitcoin hack carried out?
Security firms said the attack used standard transfers, not a smart contract exploit. CertiK's Dickson Wu said the attackers spent four hours on eight small chains, including Base, Optimism and Arbitrum, before moving to the exchange's main hot wallets. Tiny ETH transfers then followed from 27,160 different addresses.
Have any of the stolen Mercado Bitcoin funds been frozen?
Cointelegraph reported that by 16:42 UTC, Tether and Circle had frozen about $6.2 million of the stolen funds. About $20 million had moved into newly created wallets, while more than $20 million, including all 106 BTC, stayed in associated addresses identified by Mercado Bitcoin.
Did Mercado Bitcoin customers lose money in the breach?
A Mercado Bitcoin spokesperson told Cointelegraph that customers suffered no losses and that no data was leaked. The company didn't respond to requests for comment on transfers that continued after it suspended deposits and withdrawals.
