Mercado Bitcoin Halts Withdrawals After Multi-Chain Hack; Tether Freezes USDT

Mercado Bitcoin, one of Brazil's largest cryptocurrency exchanges, confirmed a security incident on Monday, Nov. 2, and suspended deposits and withdrawals. According to Hypernative, more than $40 million left wallets tied to the exchange overnight. Blockchain analysts cited by Cointelegraph estimated more than $46 million was drained. Mercado Bitcoin has not confirmed the $40 million figure. Hypernative said the transfers were ordinary signed transactions, sent as if the source wallets had authorized them, and that it is not yet clear how the attacker obtained the power to sign them. Security firms have stated the attack used standard transfers rather than a smart contract exploit. Certik's Dickson Wu said attackers first picked at eight small chains for four hours, including Base, Optimism and Arbitrum, before moving to the main hot wallets and transferring tiny amounts of Ether from 27,160 addresses. According to CryptoPotato, the first suspicious transfer came at 2:15 UTC and the largest transfers came between 6:19 and 6:53 UTC, when wallets tied to the exchange sent most of the funds to newly created addresses. Mercado Bitcoin has not disclosed how the attackers got in. Hypernative's preliminary analysis spans at least 10 blockchains, including Bitcoin, Ethereum, Solana and Tron, and the firm said it still must confirm that every source address belongs to Mercado Bitcoin. According to mempool.space data, the exchange-published Bitcoin address received about 106 BTC, mostly in one 104.4 BTC transfer at 6:41 UTC, and none had moved by 14:50 UTC. Cointelegraph reported that about $20 million had moved into newly created wallets while over $20 million remained in associated addresses identified by Mercado Bitcoin, including all 106 BTC. According to Wu, funds kept leaving addresses tied to the breach hours after the suspension was announced. Mercado Bitcoin's EVM entry listed the address 0xe485...2478. Mercado Bitcoin said it identified and quickly contained the incident, that its teams are investigating, tracking assets and coordinating with the competent authorities, and that no customer lost money and no data leaked. It published destination addresses on EVM networks, Bitcoin, Solana, Stellar and Tron so others can track the funds. Tether CEO Paolo Ardoino confirmed Tether froze more than 4.5 million USDT, and on-chain data shows two destination addresses blacklisted on Tether's Ethereum and Tron contracts. Cointelegraph reported that Tether and Circle had frozen approximately $6.2 million by 4:42 pm UTC. Neither announcement set a final recoverable total, and the Tether announcement did not say tokens had been returned. Deposits and withdrawals remain suspended with no resumption date, and the hack has not been attributed to any group. Users of any exchange can reduce exposure by not keeping more funds on a platform than they need and by using self-custody for long-term holdings. During an incident, rely on the exchange's official channels and be wary of unsolicited messages offering fund recovery or withdrawal help. Published incident addresses are meant for tracking funds, not for sending anything to. Compare any figures against the exchange's own confirmed statements, as early loss estimates from outside firms are often preliminary and revised.