Mercado Bitcoin, one of Brazil‘s largest cryptocurrency exchanges, confirmed a security incident on Monday that blockchain analysts estimated drained more than $49 million from its wallets. Despite the company’s announcement that it had suspended deposits and withdrawals, addresses associated with the incident continued to receive funds for hours afterward.
Senior security engineer at Certik, Dickson Wu, published an initial post-mortem of the incident, saying the attackers “picked at eight small chains for four hours,” including Base, Optimism and Arbitrum. The attack then moved to the companys main hot wallets before transferring tiny amounts of Ether (ETH) from 27,160 different addresses.
“So whoever did this can also move money out of MBs customer deposit addresses,” he wrote.
Security firms have stated the hack was carried out through standard transfers rather than a smart contract exploit.
Funds move despite suspension
According to Wu, hours after Mercado Bitcoin announced a temporary suspension of deposits and withdrawals, funds continued to move out of addresses tied to the breach, followed by thousands of small ETH transfers into a single address.
A spokesperson for Mercado Bitcoin told Cointelegraph that customers had suffered no losses and no data had been leaked, but the company did not respond to requests for comment on the continued transfers. A data breach could also trigger notification requirements to Brazils data protection authority.
The hack has not yet been attributed to an organized group and remains under investigation.
Of the stolen funds, by 4:42 pm UTC approximately $6.2 million had been frozen by stablecoin issuers Tether and Circle. About $20 million had been transferred into newly created wallets, while over $20 million remained in associated addresses identified by Mercado Bitcoin, including all 106 BTC.
Mercado Bitcoin joins breach list
Mercado Bitcoin had 4.5 million users as of July, when stablecoin issuer Tether announced a $20 million investment to support its expansion in tokenization, payments and credit. Another Tether-backed exchange in Latin America, Chiles Orionx, announced its closure in September after a forensic audit found that more than $7 million in customer assets had moved to wallets outside its control.
The incident comes days after Binance reported a $6.3 billion hack targeting its hot wallets on Thursday. The exchange suspended deposits and withdrawals and pledged to cover customer losses. Binance began resuming withdrawals on Sunday, saying it had replenished 95% of the stolen assets.
Magazine: THORChain founder rejects freeze request, CZ thanks Secret Service: Hodlers Digest