Mercado Bitcoin Puts Its Loss at $38M as On-Chain Counts Run Higher

Mercado Bitcoin says about $38 million of assets were involved when its hot wallets were drained on Monday, and that customers will not lose anything. Every independent count read here is higher. Hypernative's first estimate was more than $40 million, and an on-chain audit Bitquery published the same day totalled $48.5 million across ten blockchains. Deposits and withdrawals at Brazil's largest exchange were still suspended on Tuesday morning. Nobody has said how the attacker got the ability to sign transactions.

Six counts of one theft

No two accounts agree on the size. Each of these describes the same drain:

About $38 million, the exchange's own description of the assets involved.
More than $40 million, Hypernative's first estimate, carried by three accounts.
$40 million to $46 million, attributed to security firms by CoinCentral.
More than $46 million, an unnamed security firm reported by The Record.
$48.5 million on Bitquery's audit, or $47.2 million once an illiquid token is set aside.
About $49 million, Chainalysis, and the exchange's own 21:00 update in Brasilia.

The first figure and the last come from the same company on the same day. TechFlow's summary of that evening update reads $49 million as the amount taken and $38 million as what was left unfrozen; CoinDesk reads about $38 million as the loss itself. We could not establish which the company meant. Neither reading confirms the other.

Ten blockchains, or seventeen

The chain count splits as well. Hypernative and Bitquery put the drain on at least ten: Ethereum, Bitcoin, Solana, Stellar, Arbitrum, Tron, Polygon, Avalanche, XDC and BNB Chain. Chainalysis puts it at seventeen, a number one account carries and nothing else here repeats. Bitquery's table has Ethereum at $29.71 million of the total and Bitcoin at $8.30 million, while its own text gives Ethereum as $29.5 million.

Timing is the part the accounts broadly share. Pablo Sabbatella of Opsek placed the largest outflows between 06:19 and 06:53 UTC, a window of about 34 minutes. Bitquery's read of the Ethereum wallet is 06:24 to 06:48, with all ten chains paying out in roughly 21 to 25 minutes. Certik's Dickson Wu describes a longer run-up: eight smaller chains drained for about four hours before the main wallets went. The exchange posted at 12:56 UTC.

"We identified and swiftly contained a security incident in one of our systems overnight," the company said, in TFTC's translation of its Portuguese post.

The freezes have their own spread

Stablecoin issuers moved through Monday afternoon, and what they caught depends on when the count was taken. Paolo Ardoino, Tether's chief executive, is reported as confirming more than 4.5 million USDT frozen. CoinCentral had Tether and Circle at about $6.2 million combined as of 16:42 UTC, with Lookonchain tracking more than $9 million. Chainalysis puts it near $10 million; the evening update says about $11 million, frozen with help from Tether, Circle and Chainalysis. Those counts read as sequential, not contradictory. None is final.

Money kept moving while the freezes landed. About $20 million had reached new wallets by the time CoinCentral checked, and more than $20 million still sat in addresses the exchange had published, the 106 BTC among them.

The access route is still blank

What nothing establishes is the entry point. The transfers were ordinary signed transactions, not a smart-contract exploit, so the open question is how signing authority was obtained. The breached system has not been named. No account identifies an attacker, and CoinCentral states plainly that no public evidence ties this to the hot wallet theft Binance disclosed last week. Certik's Wu said the attacker was in a position to move customer deposit funds. That is not confirmed, and the company says no customer data leaked.

A regulatory clock is running alongside it. Brazil's licensing deadline for virtual asset service providers passed with no firm yet authorised, so the country's largest exchange is answering for an incident with its application still in the queue. As of TechFlow's 08:13 UTC report on Tuesday, the resumption timeline was undetermined. Whether the frozen USDT comes back is a separate question, and no issuer has answered it.