Brazil's largest cryptocurrency exchange halted deposits and withdrawals on Monday after detecting a security breach in one of its systems, and stablecoin issuer Tether moved to block a slice of the funds tied to the incident.
Mercado Bitcoin said it identified and quickly contained the intrusion in the early hours of Nov. 2. In a statement posted on X, the Sao Paulo-based platform said no customer funds were lost and no data was leaked, describing the suspension of transfers as a precautionary step while its security teams investigate.
Tether Chief Executive Paolo Ardoino said in a separate post on X that the company had frozen more than 4.5 million USDT connected to the breach. The dollar-pegged token can be blacklisted by its issuer so the units cannot be moved, though a freeze does not by itself return the money to its owner.
Blockchain security firm Hypernative flagged more than $40 million in suspicious transfers that may be tied to the incident, according to a preliminary analysis covering at least 10 networks. Mercado Bitcoin has not confirmed that figure and has not said how attackers gained access.
Scope of the suspicious flows
Hypernative's monitoring identified unauthorized movements across Bitcoin, Ethereum, Solana, Tron and Stellar, as well as Polygon, Arbitrum, Avalanche and BNB Smart Chain. The flagged assets included 106 Bitcoin and 2,852 Ethereum, with investigators tracing the first suspicious transactions to around 02:15 UTC.
Stellar drew particular attention after analysts linked roughly 6.7 million XLM to the movements. Mercado Bitcoin then published a Stellar destination address so investigators and security firms could follow the assets on-chain, and later released addresses on five network categories: EVM-compatible chains, Bitcoin, Solana, Stellar and Tron.
The EVM address disclosed was 0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478. The exchange said the list was published solely to help identify and track the funds.
Note: The $40 million figure is a preliminary estimate from Hypernative and has not been confirmed by Mercado Bitcoin. The frozen USDT amount is a separate measure and does not represent a final recoverable total.
Investigators have linked the transactions to operational wallets, raising questions about whether exchange reserves rather than segregated customer holdings were exposed. The exchange said it is coordinating with authorities to trace the transactions and identify possible laundering activity, and it has advised against new deposits until checks are complete.
A tense month for exchange security
The incident lands days after hackers drained more than $6 billion from Binance on Oct. 29, a theft the FBI attributed to North Korea's TraderTraitor group. Binance has since reopened withdrawals and said it had replenished about 95% of the affected assets. Mercado Bitcoin has not connected the two events and has not identified who was behind its own breach.
Hypernative is not a newcomer to Brazil's oversight apparatus. The country's central bank developed a real-time crypto threat monitoring and alert-sharing system with the firm, and Mercado Bitcoin and Foxbit were among the exchanges named as planned participants. The project was designed to circulate warnings between banks and crypto companies when suspicious funds moved through the financial system, and testing had been completed before the Nov. 2 incident.
Tether has positioned freezes as a way to stop the further movement of funds linked to suspected unlawful activity. In an April 23 announcement, the issuer said it had helped U.S. authorities block $344 million USDT across two addresses after receiving information about alleged misconduct, and it said it had worked with more than 340 law enforcement agencies in 65 countries.
What it means for the market
The immediate effect is operational. Mercado Bitcoin customers cannot move funds into or out of the platform, and the exchange has given no timetable for restoring service. The distinction matters: the company says balances are intact, but the restriction leaves users unable to act on them.
The broader read-across concerns how quickly a major issuer can quarantine tainted stablecoin balances. Tether's freeze gives investigators a fixed target, but it also illustrates the limits of that tool, since blocked tokens sit outside the affected exchange's control until a recovery process plays out. For traders, the episode reinforces that on-chain tracing and issuer-level blacklisting are becoming standard parts of the response to exchange breaches in major markets, including Latin America's largest.
Mercado Bitcoin said it will continue posting updates through its official channels.