Author: Protos Investigative Team
Compiled by: Deep Tide TechFlow
Deep Tide Briefing: Just as the global crypto market is focused on regulatory progress and institutional inflows, Mercado Bitcoin, Latin America’s largest homegrown compliant cryptocurrency exchange, has been hit by a major security crisis, with its on-chain custody system suffering a serious breach.
According to real-time tracking by on-chain analytics firm Arkham, hackers exploited a critical permissions vulnerability to carry out a sweeping attack on a large number of dormant addresses holding early historical deposits on the Mercado Bitcoin platform. They then aggressively dumped the stolen altcoins and meme coins on-chain. The total value of confirmed losses has now exceeded $46 million, and potential losses continue to grow as the hackers’ money-laundering trail expands.
Although the platform’s official statement claimed that the security incident had been effectively contained immediately, insisting that “customer assets were not materially affected and no internal data was leaked,” the subsequent emergency suspension of all deposits and withdrawals once again triggered industry-wide concerns about trust in compliant exchanges’ physical separation of hot- and cold-wallet access controls and their management of private keys for historical addresses.
Security incident investigation: Latin America’s largest cryptocurrency exchange, Mercado Bitcoin, has urgently suspended withdrawals across its entire platform after hackers stole assets worth approximately $46 million.
After a hack led to the illegal transfer of crypto assets estimated to be worth more than $46 million, the well-known Brazilian cryptocurrency exchange Mercado Bitcoin has urgently halted all customer deposits and withdrawals.
Officials say the situation is under control and have fully suspended deposits and withdrawals
After the incident came to light, the exchange issued a public statement insisting that its security team had successfully blocked and contained the intrusion that morning. It emphasized: “The platform’s customers have suffered no direct financial harm, and no sensitive user data has been leaked from the system.”
Officials further explained that the temporary freeze on deposits and withdrawals across the platform was purely a “preventive risk-control measure” taken out of caution. The organization’s security experts are currently working closely with “the relevant judicial and regulatory authorities” in Brazil to jointly trace the hackers’ attack path.
On-chain tracking by Arkham: Hackers are sweeping through dormant legacy addresses
However, on-chain monitoring data from Emmett Gallic, a senior security analyst at the on-chain analytics firm Arkham, paints a more troubling picture. He noted that the actual asset losses from the hack at Mercado Bitcoin have clearly exceeded $46 million, and that figure is still growing.
In an on-chain analysis report, Gallic revealed: “Our monitoring shows that the hackers are continuing to sweep funds from a large number of the exchange’s old deposit addresses, while rapidly dumping all the stolen meme coins and various altcoins on decentralized exchanges to cash out.”
To coordinate with the wider industry and prevent the stolen assets from flowing out, Mercado Bitcoin subsequently published on-chain several key wallet addresses used by the hackers to receive and transfer the stolen funds, urging major platforms and nodes to work together to track the flow of funds.
Global exchanges hit by a wave of attacks as regulators and law enforcement step in
This serious and sudden security incident comes at an exceptionally sensitive time, as cryptocurrency exchanges around the world face a series of intense cyber intrusions. Not long before, Binance, the world’s largest cryptocurrency exchange, also faced an extremely complex, sudden on-chain security alert, during which it experienced more than $6 billion in short-term net outflows.
As hackers’ methods continue to evolve and grow more sophisticated, top international law enforcement agencies, including the US Secret Service and the FBI, have become fully involved in in-depth investigations of these transnational cyber-financial crimes. Preliminary tracing assessments by several cybersecurity firms suggest that a recent series of highly sophisticated attacks may be directly linked to the notorious North Korean hacking group “Trader Traitor,” which is believed to have state-sponsored ties.
Meanwhile, law enforcement agencies have even issued emergency compliance directives to several decentralized node operators, including the THORChain cross-chain network, requiring them to block and intercept suspicious settlements involving the addresses in question at the validator-node level.
The successful breach of a compliant Latin American giant has once again sounded the alarm across the crypto industry: regulatory licenses and a vast user base do not mean an impenetrable underlying defense. Exchanges’ management of the key lifecycles for vast numbers of dormant legacy addresses, along with proactive defenses against unusual fund movements, remain critical to their survival.