Mercado Bitcoin drain moved $40 million in plain transactions, pointing to stolen signing keys
Brazil's largest crypto exchange halted all customer deposits and withdrawals on Monday, hours after wallets it operates sent more than $40 million in digital assets to attacker-controlled addresses across at least 10 blockchains.
We identified and quickly contained a security incident in one of our systems early this morning," the exchange said in a statement on X, where it also said no customer lost money and no data leaked. It paused the payment rails as a precaution while it investigates, follows the stolen assets and works with law enforcement.
The tell is in the transaction formatComunicado oficial:
- Mercado Bitcoin (@MercadoBitcoin) November 2, 2026
Identificamos e contivemos com rapidez um incidente de seguranca em um de nossos sistemas nesta madrugada.
Reforcamos que:
Nao houve nenhum prejuizo aos clientes;
Nao houve vazamento de dados.
Como medida preventiva de protecao, depositos e saques...
The technical detail that matters most here is what kind of transfers the attacker used. A report relayed by Pablo Sabbatella, founder of crypto security firm Opsek, says the stolen funds moved as plain transactions, not through a smart contract exploit. A plain transaction is an ordinary wallet-to-wallet transfer: it needs nothing but the sender's private key. A contract exploit, by contrast, abuses a bug in on-chain code, and typically shows a single clever call to one contract rather than hundreds of routine sends.
That difference points to a specific failure mode. If wallets on Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC and Stellar all started sending funds to fresh addresses, the attacker most likely obtained the signing keys for the exchange's hot wallets, the internet-connected wallets exchanges use to process withdrawals at speed. Cold storage and multi-party signing exist precisely to keep those keys offline and split them up; a drain this broad suggests the operational keys were exposed in bulk. The report puts the biggest outflow window between 06:19 and 06:53 UTC, roughly half an hour in which wallets on nearly a dozen chains emptied at once. Its tally of the attacker's current holdings reads about 2,852 ETH, 106 BTC, 10,700 SOL, 77,000 AVAX and 6.7 million XLM, with smaller positions spread across some 200 additional tokens, though those figures come from a single on-chain analysis.
The exchange has not confirmed the $40 million estimate from security firms including Hypernative, and it has not disclosed how the attacker got in. In a follow-up post it published the destination addresses it identified on five networks, EVM chains, Bitcoin, Solana, Stellar and Tron, so other services can track the funds.
What a freeze can and cannot fixThe first concrete recovery step came from Tether. Tether froze more than 4.5M USDT related to this security incident," CEO Paolo Ardoino said on X. Tether can blacklist addresses holding its dollar-pegged stablecoin so the tokens cannot move, but a freeze does not by itself return funds to their owner. It also covers only a slice of the loss: most of the attacker's holdings sit in ETH, BTC, SOL, XLM and AVAX, assets no issuer can freeze.
Tether froze more than 4.5M USDT related to this security incident. https://t.co/PCtP4957jn
- Paolo Ardoino (@paoloardoino) November 2, 2026
The incident lands four days after hackers drained more than $6 billion from Binance on October 29, a theft the FBI attributed to North Korea's TraderTraitor group. Binance has since reopened withdrawals and said it replenished about 95% of the affected assets. That attack, like this one, reportedly came through compromised operational access rather than chain-level code, a pattern covered in the Binance breach that came through a laptop, not a smart contract. No attribution has been made in the Mercado Bitcoin case, and there is no public evidence linking the two incidents.
Deposits and withdrawals at Mercado Bitcoin remain suspended, and the exchange has not given a date for resuming them.
The post Mercado Bitcoin drain moved $40 million in plain transactions, pointing to stolen signing keys appeared first on Techreport.