Mercado Bitcoin Estimates $38 Million Security Incident, Says Clients’ Assets Are Safe

Mercado Bitcoin’s first estimate puts the assets involved in Monday’s security incident at about $38 million. The Brazilian exchange says clients won’t lose assets, while deposits and withdrawals remain paused as it works to contain the incident. Those two statements describe different parts of the situation: the estimated value connected to the incident, and the exchange’s assurance about what customers will ultimately bear.

That distinction matters. A figure tied to affected assets doesn’t, by itself, establish how much was permanently lost, recovered, or made available to customers. Mercado Bitcoin hasn’t laid out those details yet, so the $38 million estimate is an early account of the incident rather than a complete financial picture. The exchange’s promise is clear; the mechanics behind it are not.

In a Portuguese-language update posted at 6:17 p.m. ET Monday, Mercado Bitcoin said it had blocked $11 million with help from Tether, Circle, Paxos, BRL1 and Chainalysis. The exchange said it had identified additional funds that might be blocked and that containment efforts were continuing.

The update offers a concrete measure of progress, though it leaves open how much of the remaining amount might be recoverable. Blocking funds can limit their movement when an intermediary or tracing process can help identify them, but the statement doesn’t specify the status of every asset or address. For now, the exchange is describing an active response, not a completed recovery.

Services paused as security work continues

Mercado Bitcoin detected the issue in the early hours of Monday and activated its security protocols, suspending services as a precaution to protect client assets. In the first post of its evening thread, the exchange said, “you will not suffer any loss of assets.” The pause shows that the incident affected ordinary account operations, even as the company says customer holdings are protected.

Freezing deposits and withdrawals can help an exchange limit activity while it checks systems and assesses exposure. It also leaves customers unable to move funds through the platform during the review. That tradeoff is familiar in exchange incidents: restricting access may reduce the chance of further harm, but it shifts the immediate burden onto users waiting for service to return.

The exchange hasn’t provided a timeline for restoring deposits and withdrawals. It says services will resume when security conditions are fully in place, with timing communicated through official channels. That leaves customers with no firm estimate of how long the interruption will last, and makes the next official update the clearest available signal of whether containment has progressed.

Here’s the thing: a service pause is only useful to customers if the exchange can explain what it’s checking and what conditions must be met before reopening. Mercado Bitcoin has said that security conditions will guide the decision, but it hasn’t publicly described those conditions. The operational caution is understandable; the lack of detail limits customers’ ability to judge the status for themselves.

Exchange estimate trails outside figure

Mercado Bitcoin’s $38 million estimate is lower than the more than $40 million that security firm Hypernative said had been drained from wallets it linked to the exchange, according to Unchained’s earlier report. The figures are close enough to describe the same broad scale, but they aren’t identical, and the available statements don’t explain the gap.

Different estimates can reflect different wallet coverage, timing, or methods of identifying affected transfers. Those are general possibilities, not explanations confirmed in this case. Until Mercado Bitcoin clarifies what its estimate includes, readers should treat both figures as reported assessments rather than a settled accounting of losses.

The exchange’s first statement on Monday said clients had suffered no losses and that no data had leaked, but offered no amount. A subsequent update named destination addresses associated with movements on EVM chains, Bitcoin, Solana, Stellar and Tron to support tracking efforts.

That sequence shows how the public account developed: an initial assurance, then information intended to support tracking, followed by an estimate and an update on funds blocked. Naming destination addresses can give investigators and other participants details to monitor, but the statement doesn’t establish what happened to every transfer. The exchange’s disclosures have added useful detail, while leaving key questions about the incident and its full scope unanswered.

Cause remains undisclosed

Mercado Bitcoin hasn’t explained how the incident occurred. It followed a Binance hot-wallet drain on Oct. 29, four days earlier. The timing places two security incidents close together, but it doesn’t establish that they share a cause or that one event is connected to the other.

On Monday, Opsek founder Pablo Sabbatella warned in an interview with Unchained that “if the industry really doesn’t wake up,” then “things are gonna get far worse.” He pointed to rapid advances in AI as a source of concern. His warning raises a broader question about how attackers may use new tools, but the source doesn’t connect AI to Mercado Bitcoin’s incident. That distinction should stay clear while the exchange hasn’t disclosed a cause.

What customers and the industry should watch

This is more significant than it looks: the most useful information over the next stage won’t be another headline figure alone, but a clearer account of what the exchange has confirmed. Customers will want to know when deposits and withdrawals can resume, whether any data was exposed, and how the assurance against client losses applies to the assets involved. Mercado Bitcoin has addressed some of those points, but not yet with a full explanation.

If you’re working in this space, the incident is a reminder that security response is also a communications test. Customers need timely updates they can distinguish from estimates, while investigators need information that helps trace funds. The exchange’s public posts have supplied addresses and a partial recovery figure; a clearer account of the method and remaining uncertainties would help readers understand what those details mean.

And yet, the pause itself carries information. Mercado Bitcoin hasn’t said services will return on a fixed schedule, which suggests the exchange is tying restoration to its assessment of security rather than to a public deadline. That may be the responsible choice, but it leaves users dependent on the company’s next explanation. The test now is whether that explanation becomes more specific as the investigation continues.

The cause remains unknown. The customer assurance remains in place. The gap between those two facts is where the next updates matter most.

Related Listen: How Attackers Stole $388M From Bitget Without Its Keys: Uneasy Money