Brazil’s largest exchange was hacked for around $40 million — and its response: the exchange will cover all losses, so customers won’t lose anything.
The facts: Mercado Bitcoin halted deposits and withdrawals on Monday, Nov. 2, following a security incident in one of its systems. Security firm Hypernative tracked more than $40 million leaving wallets linked to the exchange across at least 10 blockchains — around 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM, plus 200+ other tokens, with most of the funds moving within a 34-minute window. The exchange itself said around $38 million was lost, and $11 million had already been frozen with help from Tether, Circle, and Chainalysis. On Nov. 3, the exchange promised to cover all losses so customers wouldn’t bear any of them, and said no customer data had been leaked.
My take: this reimbursement promise matters, but the biggest question remains unanswered: how did the attacker gain access to signing when, according to Hypernative, these were ordinary transfers, not a smart contract exploit? The difference between the estimates — $38 million from the exchange, over $40 million from Hypernative, and $49 million from Chainalysis — also shows that the final figure is still in flux. And the timing is rough: this incident came four days after the Binance hack, though neither party has linked the two.
What I’m watching: when services resume, whether the frozen $11 million is actually recovered, and the official explanation of the signing-access vulnerability.
What do you think: is the promise that “customers won’t lose money” enough, or should the exchange first explain how the attacker got hold of signing access?
This is my analysis, not financial advice — always DYOR.
#KeamananCrypto #BursaCrypto $BTC
The facts: Mercado Bitcoin halted deposits and withdrawals on Monday, Nov. 2, following a security incident in one of its systems. Security firm Hypernative tracked more than $40 million leaving wallets linked to the exchange across at least 10 blockchains — around 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM, plus 200+ other tokens, with most of the funds moving within a 34-minute window. The exchange itself said around $38 million was lost, and $11 million had already been frozen with help from Tether, Circle, and Chainalysis. On Nov. 3, the exchange promised to cover all losses so customers wouldn’t bear any of them, and said no customer data had been leaked.
My take: this reimbursement promise matters, but the biggest question remains unanswered: how did the attacker gain access to signing when, according to Hypernative, these were ordinary transfers, not a smart contract exploit? The difference between the estimates — $38 million from the exchange, over $40 million from Hypernative, and $49 million from Chainalysis — also shows that the final figure is still in flux. And the timing is rough: this incident came four days after the Binance hack, though neither party has linked the two.
What I’m watching: when services resume, whether the frozen $11 million is actually recovered, and the official explanation of the signing-access vulnerability.
What do you think: is the promise that “customers won’t lose money” enough, or should the exchange first explain how the attacker got hold of signing access?
This is my analysis, not financial advice — always DYOR.
#KeamananCrypto #BursaCrypto $BTC