Security Breach at Mercado Bitcoin: $40 Million in Assets Compromised, 6.7 Million Stellar Tokens Stolen

Mercado Bitcoin Security Incident

Mercado Bitcoin, a prominent Brazilian cryptocurrency exchange, has recently acknowledged a security incident affecting its systems. As a precautionary measure, the platform has halted all deposit and withdrawal functions. The company has assured users that their assets remain secure and that there has been no data breach associated with this event.

Incident Timing and Suspicious Outflows

The timing of this incident is noteworthy, occurring just after the exchange met a crucial local licensing deadline. In an analysis released by blockchain monitoring firm Hypernative, it was revealed that over $40 million (approximately 217 million reais) had been identified as suspicious outflows from the exchange's linked wallets. The transfer of these funds affected a wide range of blockchains, including Ethereum, Bitcoin, Solana, Tron, and Stellar, with additional activity observed on Polygon, Arbitrum, Avalanche, and the BNB Smart Chain.

The first alerts of unusual transactions were detected around 02:15 UTC, notably involving Bitcoin deposit addresses associated with Mercado Bitcoin.

Details of Suspicious Transactions

Among the identified suspicious assets were significant numbers: 106 BTC and 2,852 ETH. The nature of these transactions points towards the involvement of operational reserves rather than client-held assets, as the hackers executed direct token transfers. Particularly alarming was the significant amount of Stellar tokens withdrawn — roughly 6.7 million XLM — which were consolidated to addresses connected to these dubious transactions.

Investigation and User Advisory

To assist in the investigation and aid cybersecurity firms in tracing these assets, Mercado Bitcoin has made a specific Stellar address public for real-time monitoring. This effort focuses on overseeing the token flow and preventing the potential laundering of illicitly obtained funds through third-party services.

Currently, the exchange is intensively investigating the breach while tracking the affected assets. They have pledged to keep their users informed with regular updates regarding the situation. However, the platform has yet to release details about the compromised system, the exact amount of funds involved, or an estimated timeline for the resumption of normal operations. Until the exchange can ensure the integrity of its systems, users are strongly advised against initiating any new deposits.