Brazilian Exchange Mercado Bitcoin Hit by $40M Security Breach
Cointime reports: Mercado Bitcoin, Brazil’s largest cryptocurrency exchange, has disclosed a security incident resulting in the theft of nearly $40 million in crypto assets across multiple blockchains, including Bitcoin, Ethereum, and Solana. The exchange stated it will use its own funds to cover affected users, ensuring no customer losses.
On-Chain Fund Flow Analysis
Blockchain security firm Beosin has traced the primary stolen funds (approximately $30 million) using its Beosin Trace platform. The analysis reveals a sophisticated laundering operation:
- Bitcoin: 106.06 BTC (worth ~$8.53 million) remains in address 19qGpsHvzh1t6pVi526XNNkh6hW6prDZp, unmoved.
- Solana & Ethereum: Attackers siphoned USDC, USDT, SOL, and various altcoins (RENDER, WIF, KMNO, POPCAT) from Solana hot wallets, then dispersed funds across multiple addresses before using cross-chain bridges (Chainflip, Myan, Relay) to swap assets into Ethereum-based ETH.
Notably, Relay bridge successfully blocked ~340,000 USDT from being swapped and bridged to Ethereum, and these funds were later returned to the victim.
On Ethereum, the attacker’s address 0xe485e7a70b1131216cb47ca4555c4bbb2c742478 received 3,653 ETH, 2,249,314 USDC, 3,059,424 USDT, and various altcoins (SHIB, PEPE, UNI, ONDO, PENDLE). All USDC and USDT holdings have been frozen. The attacker converted altcoins to ETH and分散ed them to multiple addresses, currently holding:
- 0x59a919e8d0582ce62c8de9431b3ebc6fa121731e (2,979 ETH)
- 0x071f8366375fdd21423bb23ae19e4b91f03f9270 (669.99 ETH)
- 0xbddd1369a581541e034c6b9790178d51e1013dab3 (50.57 ETH)
Industry Implications: Cross-Chain Bridges as Laundering Hubs
This incident highlights the growing use of cross-chain bridges by attackers to obscure fund trails. While bridges like Relay demonstrated proactive security by blocking suspicious transactions, the overall landscape remains challenging. The freezing of stablecoins on Ethereum shows the effectiveness of centralized stablecoin issuers in responding to hacks, but the dispersion of ETH into multiple wallets complicates recovery efforts.
Mercado Bitcoin’s decision to reimburse users from its own reserves underscores the importance of exchange solvency and insurance mechanisms. However, the breach raises questions about hot wallet security practices, especially for exchanges operating across multiple chains.
Forward-Looking Perspective
As the investigation continues, the final loss amount and attack vector remain unclear. Beosin has flagged all related addresses and is monitoring activity. This case is likely to accelerate adoption of enhanced cross-chain monitoring tools and stricter bridge security protocols. Exchanges may also reevaluate their hot wallet exposure and consider multi-signature and MPC-based custody solutions. Regulators, particularly in Latin America, may push for stricter cybersecurity requirements for crypto service providers. The industry must collaborate on real-time threat intelligence sharing to prevent similar incidents.
