GoKawiilMercado Bitcoin halts deposits after $40M drained via compromised hot-wallet keys
Brazil's largest crypto exchange, Mercado Bitcoin, suspended all deposits and withdrawals on Monday after wallets it controls sent over $40 million to attacker-controlled addresses across at least 10 blockchains. The company says it has contained the breach, found no customer losses or data leaks, and is working with law enforcement while tracing the funds.
GoKawiil's interpretation of the reporting above, not reported fact.
Security researcher Pablo Sabbatella notes the funds moved as ordinary wallet-to-wallet transfers rather than through a smart contract exploit, which suggests attackers obtained private signing keys rather than exploiting code. That pattern points toward a breach of the exchange's hot-wallet infrastructure across many chains at once, a failure mode that safeguards like cold storage and multi-party signing are designed to prevent, raising questions about how those protections held up.
- Over $40 million moved from Mercado Bitcoin wallets to attacker addresses across 10+ blockchains.
- Transfers used plain transactions, suggesting stolen private keys rather than a smart contract exploit.
- Exchange halted deposits/withdrawals, reports no customer funds lost or data leaked, and is investigating with law enforcement.
Ledger Nano X hardware wallet — Exchange hacks like this one underscore why holding crypto on a centralized platform carries real custodial risk. A hardware wallet like the Ledger Nano X keeps your private keys offline and in your own control, so an exchange's compromised signing keys can't touch your funds. It's a practical step anyone holding crypto can take right now to reduce exposure to incidents exactly like this.
See Ledger Nano X hardware wallet on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: techreport.com — Krishi Chowdhary, 2026-11-03
Published there as: “Mercado Bitcoin drain moved $40 million in plain transactions, pointing to stolen signing keys”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.