⏱ 2 min read
Certik’s Dickson Wu says attackers hit eight smaller chains before hot wallets, as issuers froze $6.2M and Mercado Bitcoin said customers took no loss.
Brazil’s Mercado Bitcoin paused deposits and withdrawals after a security breach that blockchain analysts estimated drained more than $49 million. Despite the suspension, addresses tied to the Mercado Bitcoin hack kept receiving funds for hours, the report said.
How the attack unfolded across chains
Dickson Wu, a senior security engineer at Certik, published an initial post-mortem saying the attackers “picked at eight small chains for four hours,” including Base, Optimism and Arbitrum. According to Wu, the operation then moved to the exchange’s main hot wallets before sending tiny amounts of Ether from 27,160 different addresses. “So whoever did this can also move money out of MB’s customer deposit addresses,” he wrote.
The report said security firms described the theft as standard transfers rather than a smart contract exploit. That mechanism means operational pauses do not freeze attacker-controlled wallets, and on-chain outflows can continue even after an exchange halts customer transactions.
▼ 1.56%
Prices as of 2026-11-02 21:02 UTC. Source: CoinGecko.
Where the funds are now
Hours after the pause, funds continued to move from addresses tied to the breach, followed by thousands of small ETH transfers into a single address, according to Wu. By 4:42 pm UTC, approximately $6.2 million had been frozen by stablecoin issuers Tether and Circle, the report said. About $20 million had been sent to newly created wallets, while over $20 million remained in associated addresses identified by Mercado Bitcoin, including all 106 BTC. Taken together, those buckets account for more than $46.2 million of the estimated haul ($6.2m + about $20m + over $20m).
A spokesperson for Mercado Bitcoin told the report that customers suffered no losses and no data had been leaked, but did not comment on the continued transfers. The report noted that a data breach could trigger notification requirements to Brazil’s data protection authority. The hack has not been attributed to a group and remains under investigation.
Mercado Bitcoin had 4.5 million users as of July, when Tether announced a $20 million investment to support its expansion in tokenization, payments and credit. Another Tether-backed exchange in Latin America, Chile’s Orionx, closed in September after a forensic audit found more than $7 million in customer assets had moved to wallets outside its control. The incident also follows days after Binance reported a $6.3 billion hot-wallet hack; the exchange paused flows, pledged to cover customer losses and said it had resumed withdrawals after replenishing 95% of the stolen assets.
Source: Cointelegraph.
This article was written with AI assistance and reviewed by an editor.
This content is for informational purposes only and does not constitute financial advice.
🧠 HafidWatch Take
The exchange’s claim of no customer losses sits against a security engineer’s view that the attacker can move funds from customer deposit addresses. Linked wallets kept sending assets after the pause, and firms described standard transfers, not a contract flaw. The reporting does not show whether the small ETH moves touched customer balances or only exchange-controlled accounts, so both statements could still hold. On-chain attribution of the funded addresses would resolve that gap.
Daily crypto intelligence. Before the market opens.
Including the Divergence Index — the sentiment gap no other newsletter tracks. Free, every morning at 7:30am ET.
✓ Free forever · ✓ No spam · ✓ 50+ sources monitored
