Mercado Bitcoin wallets show post-hack transfers after $46M theft

A centralized exchange can pause its own deposit and withdrawal systems without stopping the blockchains where its wallets exist. The suspension blocks normal customer activity through Mercado Bitcoin’s platform. It does not automatically disable blockchain addresses or revoke whoever controls their signing keys. That distinction matters because on-chain transfers can continue independently of the exchange’s website and internal systems.

In this incident, addresses tied to the breach continued moving funds for hours after Mercado Bitcoin announced the suspension. Dickson Wu reported that money moved out of affected addresses, followed by thousands of small ETH transfers into one address. He also warned that the attacker might be able to move funds from customer deposit addresses.

The continued activity made the breach more serious and complicated the response. Mercado Bitcoin said customers had suffered no losses, but the transfers remained under investigation. The incident also raised questions about wallet control, monitoring, possible data exposure, and whether additional assets could be reached.

Blockchain analysts estimated that the theft drained more than $46 million from Mercado Bitcoin wallets. The scale was not limited to one chain or one large transaction. Certik’s Dickson Wu said the attackers worked across eight smaller chains for four hours, showing a broad and sustained operation.

The attack included Base, Optimism, and Arbitrum before moving into Mercado Bitcoin’s main hot wallets. The attackers then transferred tiny amounts of Ether from 27,160 different addresses. Wu said the activity suggested the person controlling the wallets might also be able to move money from customer deposit addresses. The article does not give one combined total for transfers across every address.

By 4:42 pm UTC, about $6.2 million had been frozen by Tether and Circle. Roughly $20 million had entered newly created wallets, while more than $20 million remained in associated addresses, including all 106 BTC. The funds’ locations shaped the recovery effort.

A hot wallet is a cryptocurrency wallet connected to systems that can transact online. Exchanges use hot wallets to handle funds that need to move quickly, including deposits, withdrawals, and internal transfers. Their accessibility is useful, but it also creates a security risk: whoever controls the wallet’s private signing authority can approve blockchain transactions.

Mercado Bitcoin’s attackers first “picked at eight small chains for four hours,” according to Dickson Wu. The attack then moved to the exchange’s main hot wallets. From there, the attackers transferred tiny amounts of ETH from 27,160 addresses. Security firms said the activity used standard transfers rather than a smart contract exploit.

Control of a hot wallet does not necessarily prove every customer lost funds. Mercado Bitcoin said customers suffered no losses and that no data had leaked. However, the incident showed why exchanges must protect wallet keys, separate funds, monitor unusual transfers, and quickly isolate affected addresses when control may be compromised.

Mercado Bitcoin said customers had suffered no losses, so the article does not establish that customer balances were taken. The stolen assets were drained from wallets associated with the exchange and the security incident. Wu nevertheless warned that the attacker might also be able to move money from customer deposit addresses, making the scope of the risk important.

The company paused deposits and withdrawals while funds continued moving on-chain. About $6.2 million was frozen, around $20 million moved into newly created wallets, and more than $20 million remained in associated addresses. These figures show that the exchange faced a major operational and recovery challenge even while denying customer losses.

The breach could still affect customers through interrupted access to funds, uncertainty, and possible exposure of deposit information. Mercado Bitcoin said no data had leaked, but a confirmed data breach could trigger notification requirements to Brazil’s data protection authority. The incident could also harm the exchange’s reputation and increase investigation costs.

Tether and Circle froze approximately $6.2 million of the stolen funds by preventing identified stablecoins from being moved. This is possible because major stablecoins are issued and managed by identifiable companies, rather than existing as completely uncontrollable assets. When issuers detect suspicious funds and identify the relevant token addresses, they can use controls in their token systems to restrict transfers.

The article reports that the freeze had occurred by 4:42 pm UTC. It does not specify how much came from Tether’s tokens or Circle’s tokens, nor does it describe the precise technical steps. It does show that the stolen funds were not equally recoverable: about $20 million had moved into newly created wallets, while more than $20 million remained in associated addresses.

Stablecoin issuers therefore can support exchanges and investigators by blocking some assets after a breach. Their involvement may limit losses, but it does not stop ordinary cryptocurrency transfers across other networks or recover every stolen asset. The case also highlights the different control models within crypto markets.

A theft through ordinary transfers means an attacker gained enough control of a wallet or its signing process to approve valid transactions. The blockchain then treats those transfers like any other authorized movement. A smart contract exploit is different: it abuses a flaw in code that automatically governs a token, application, or financial protocol. The weakness may let an attacker obtain assets without directly taking over a wallet’s normal transfer process.

Security firms said the Mercado Bitcoin hack was carried out through standard transfers rather than a smart contract exploit. Wu described attackers moving across eight small chains, then entering the exchange’s main hot wallets. They also sent tiny amounts of ETH from 27,160 addresses, suggesting repeated wallet-level activity.

That distinction matters for investigation and prevention. A contract bug points investigators toward application code and transaction logic. Ordinary transfers point more directly toward wallet access, signing authority, or operational security. The article says the attacker has not been identified, and the incident remains under investigation.

A blockchain wallet is an address controlled by a private key or another signing system. When a transfer is authorized, the network checks the signature, confirms that the sender can spend the assets, and records the transaction on its distributed ledger. Once accepted, the transfer becomes visible as blockchain activity and is generally difficult to reverse. The wallet itself does not need a centralized exchange website to operate.

That separation explains Mercado Bitcoin’s continuing transfers. The exchange announced a temporary suspension of deposits and withdrawals, but addresses tied to the breach kept moving funds. The activity included transfers out of affected addresses and thousands of small ETH transfers into one address. The article also reports movement across Base, Optimism, Arbitrum, and five other smaller chains.

A centralized exchange can block its own customers and internal services. It may also freeze assets issued by companies such as Tether and Circle when those issuers cooperate. But it cannot simply erase valid transactions from independent blockchains. The case makes rapid wallet isolation and monitoring especially important.