Hot Wallets on a Dozen-Plus Chains Drained Within Half an Hour: What the Mercado Bitcoin Incident Means for Small Teams

In the early hours of November 2 (Brazil time), Brazilian exchange Mercado Bitcoin detected and contained a security incident and suspended all transactions on its platform. In a later update, the exchange said about $38M in assets is involved, that it has frozen about $11M with partners including Tether, Circle, Paxos, BRL1 and Chainalysis, and that further freezable amounts have been identified. It says customers will not lose assets because of the incident. No date has been given for restoring service.

The exchange has not said which system was affected or how the attacker gained the ability to move funds. Independent estimates run as high as about $49M spread across more than a dozen chains, and according to security researchers most of the transfers happened within roughly 34 minutes.

Where small teams are exposed

Five things you can do now

• List the hot wallet addresses and balances on every chain, set a cap based on normal withdrawal needs, and move anything above it to cold storage or a multisig
• Write an incident contact sheet: freeze request channels for stablecoin issuers, risk contacts at partner exchanges and your on-chain tracing provider, plus who makes each call and what information they need ready
• Make sure the on-call person can halt withdrawals on every chain within minutes. Drill it every quarter and record how long it actually takes
• Alert on hot wallet outflows: a single transfer or hourly total above threshold, or a transfer to an address you have never used, should page a person directly, including at night
• Find out which people and services can sign on multiple chains, and keep them separate from everyday office and development environments

The trading suspension, the amount involved, the frozen amount and the no-customer-loss commitment come from Mercado Bitcoin's official statements. The $49M figure is an independent estimate attributed to Chainalysis in press reports, and the 34-minute window comes from on-chain analysis by security researchers. The affected system, the intrusion method and attribution have not been disclosed, and this article does not speculate. This article does not cover attack details.