Mercado Bitcoin has stopped customers from moving money in or out after a security incident at the Brazilian crypto exchange. Researchers have flagged more than $40 million in suspicious transfers, leaving users waiting for answers about what happened and when withdrawals will return.
The company said on November 2 that it had quickly contained the incident in one of its systems. It also said customers had suffered no losses and no data had leaked. The $40 million estimate has not been confirmed by the exchange.
In its initial statement, translated from Portuguese, the company said:
We identified and quickly contained a security incident in one of our systems early this morning.
Deposits and withdrawals were suspended as a protective measure, it said. Teams were investigating, tracing assets and working with the relevant authorities. The announcement didn't identify those authorities or give a time for services to resume.
The exchange has now published destination addresses
A later update gave investigators something more concrete to follow: destination addresses linked to movements associated with the incident.
The list covered EVM-compatible networks, Bitcoin, Solana, Stellar and Tron. EVM refers to the Ethereum Virtual Machine, a system used by Ethereum and other blockchains. A single EVM address can therefore be used across several networks.
The exchange said the addresses were being shared only for identification and tracking. It didn't attach a dollar amount to each address or name anyone behind the incident.
It also said, translated from Portuguese:
We continue working to safely restore operations and will keep our customers informed through our official channels.
For customers, that's the immediate problem. The company has offered assurances about their money, but its update still gave no reopening deadline. It also didn't explain which system had been affected or how someone gained access.
Where the $40 million figure comes from
Blockchain security firm Hypernative identified more than $40 million in suspicious transfers across at least 10 blockchains, according to Wu Blockchain's November 2 report. The networks named in that account included Bitcoin, Ethereum, Solana and Tron.
That figure is a preliminary estimate of suspicious movements. Wu Blockchain said the exchange had not confirmed the estimated losses and that the attack method remained unknown. No conclusion about stolen customer balances can be drawn from the transfer total alone.
The company's own status page showed problems beyond withdrawals. On Monday it listed the trading API, login, mobile app and registration as fully unavailable, while the website itself was marked operational. Those entries were labeled as being investigated and said they had been created by an automated monitoring service.
That helps explain why an exchange's website can still open while customers struggle to use their accounts. It doesn't establish that every listed outage had the same cause.
A halt at a platform serving millions
The disruption comes days after Mercado Bitcoin announced plans to expand access to assets on Sui. In an October 29 announcement, the Sui Foundation described the exchange as having 4.5 million clients and said it would offer SUI, USDC and Sui Dollar.
The same announcement outlined plans to bring the exchange's tokenized real-world assets onto Sui. A possible integration of Hashi, Sui's Bitcoin lending infrastructure, was still being explored, with no product offering available at that point.
That partnership is background to the size of the business affected. Neither the exchange's incident statements nor the researcher account linked the security problem to the Sui integration.
Anyone checking the published destination addresses should treat them as tracking information. They are not deposit instructions or a route to recover an account. The company said it would keep posting updates through its official channels; a restart notice and a fuller account of the transfers would give customers the next answers they're waiting for.