Latin America's Largest Crypto Exchange Mercado Bitcoin Hacked, Suffers Over $46 Million in Losses and Emergency Withdrawal Suspension
Author: Protos Investigation Team
Compiled by: TechFlow
TechFlow Guide: As the global crypto market closely monitors compliance advancements and institutional capital inflows, Mercado Bitcoin, Latin America’s largest local compliant cryptocurrency exchange, has been struck by a major security incident, with its on-chain custody infrastructure severely compromised.
Real-time tracking data from on-chain analytics firm Arkham indicates that hackers exploited critical permission vulnerabilities to conduct a sweeping scan of numerous historical early-deposit dormant addresses on the Mercado Bitcoin platform. They have since aggressively dumped stolen altcoins and meme coins on-chain, with confirmed lost crypto assets already surpassing $46 million. Furthermore, as the hackers’ money laundering trails extend, potential losses continue to escalate.
Although the platform officially claimed to have rapidly contained the security breach and firmly stated that “customer assets were not substantially impacted and no internal data leaks occurred,” the subsequent emergency suspension of all deposit and withdrawal services has once again triggered industry-wide concerns regarding the physical separation of hot/cold wallet permissions at compliant exchanges and the private key management of historical addresses.
Security Incident Investigation: Following the theft of approximately $46 million in assets by hackers, Latin America’s largest cryptocurrency exchange, Mercado Bitcoin, has urgently suspended platform-wide withdrawal functions.
Due to the illegal transfer of crypto assets estimated at over $46 million caused by the cyberattack, the Brazil-headquartered prominent exchange Mercado Bitcoin has now urgently halted all customer deposit and withdrawal services.
Officials Claim Situation Controlled and Halt All Deposits/Withdrawals
After the incident was exposed, the exchange issued an official statement insisting that its security team successfully blocked and contained the intrusion earlier that day. The statement emphasized: “Platform users have suffered no direct financial harm, and no sensitive user data has been compromised internally.”
The official further explained that the temporary freeze on network-wide deposit and withdrawal functions was strictly a “preventive risk control measure” taken out of prudence. Currently, the institution’s cybersecurity experts are closely collaborating with Brazil’s “competent judicial and regulatory authorities” to jointly trace and investigate the attackers’ paths.
Arkham On-Chain Tracking: Hackers Drastically Sweeping Early Dormant Addresses
However, on-chain monitoring data provided by Emmett Gallic, a senior security analyst at Arkham, depicts a much grimmer scenario. He notes that the actual scale of asset loss from Mercado Bitcoin’s hack has clearly exceeded $46 million and continues to grow dynamically.
Gallic revealed in an on-chain analysis report: “Monitoring shows that hackers are currently conducting a systematic sweep of funds across numerous historical old deposit addresses under this exchange, while simultaneously executing rapid, concentrated sell-offs to cash out all stolen meme coins and various altcoins on decentralized exchanges.”
To coordinate industry-wide efforts to intercept the outflow of stolen assets, Mercado Bitcoin subsequently published several core wallet addresses used by the hackers to receive and transfer the illicit funds on-chain, urging major platforms and nodes to collaboratively track the fund flows.
Global Experiences Intense Wave of Attacks as Regulators and Law Enforcement Step In
This sudden malicious security incident occurs during an extremely sensitive period marked by continuous high-intensity cyber intrusions targeting global crypto exchanges. Just prior to this, the world’s largest crypto exchange, Binance, also faced a highly complex on-chain security alert, resulting in over $6 billion in short-term net capital outflows during that timeframe.
As hacker tactics continue to evolve and become more sophisticated, top international law enforcement agencies such as the US Secret Service and the FBI have fully launched in-depth investigations into these transnational cyberfinancial crimes. Preliminary attribution by multiple cybersecurity firms suggests that a recent series of highly professionalized attacks are highly likely directly linked to the notorious North Korean hacker group “Trader Traitor,” known for its state-sponsored background.
Simultaneously, law enforcement authorities have even issued emergency compliance directives to several decentralized node operators, including the THORChain cross-chain network, mandating they strictly block and intercept abnormal fund settlements involving the implicated addresses at the validator node level.
Faced with the successful penetration of Latin America’s compliance heavyweight by hackers, the entire crypto sector has once again been soundly warned: compliance licenses and massive user bases by no means guarantee impregnable foundational defenses. Proactive defense against anomalous fund movements and lifecycle management of keys for vast quantities of historical early dormant addresses remain the core lifelines determining a platform’s survival.