> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# Mercado Bitcoin confirms $46M heist as experts dispute customer fund safety
- URL: https://f4n6.co.uk/security-feed/mercado-bitcoin-confirms-46m-heist-as-experts-dispute-customer-fund-safety/
- Published: 2026-11-03T10:19:25.000Z
- Updated: 2026-11-03T10:19:25.000Z
- Author: Jeff Davies
- Tags: #security-feed, Lazarus Group

## 1\. Executive summary

Brazilian cryptocurrency exchange Mercado Bitcoin suspended all deposits and withdrawals after a cybersecurity incident on Monday morning, and blockchain security companies said more than $46 million left the platform late on Sunday night, a figure Mercado Bitcoin has not confirmed. The company says the attack did not harm customers and did not cause a data breach, but several blockchain security experts dispute that, citing blockchain evidence that funds were taken from some customer wallets. Tether froze about $4.5 million of the stolen funds and other platforms froze a further $2 million, leaving the majority of the reported loss unrecovered. No CVE, malware family, initial access vector or named threat actor is identified in public reporting on this incident. The direct risk to EMEA financial services is low; the exposure that matters is counterparty and settlement risk for firms holding client assets on, or routing crypto liquidity through, the platform.

## 2\. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

## 3\. Technical analysis & attack chain

Mercado Bitcoin has confirmed that a cybersecurity incident occurred and that it suspended deposits and withdrawals. It has not published the access vector, the affected systems, the timing beyond "Monday morning", or the mechanism by which funds left the platform. The following is what public reporting establishes, not a reconstructed intrusion.

1. Late on Sunday night, blockchain security companies observed more than $46 million leaving the platform. Mercado Bitcoin has not confirmed this figure and did not respond to requests for comment.
2. On Monday morning Mercado Bitcoin suspended all deposits and withdrawals and described the event as a cyberattack.
3. The company stated the attack did not harm customers and did not lead to a data breach, and said its teams were investigating, tracking the assets and coordinating with the competent authorities.
4. Mercado Bitcoin published destination addresses for the stolen funds and pledged to restore the platform in the coming days.
5. Tether froze about $4.5 million of the stolen funds at Mercado Bitcoin's request, per Tether CEO Paolo Ardoino, and other platforms froze a further $2 million.
6. Chainalysis said its investigators are tracking the coins so the industry can "identify, freeze, and disrupt impacted funds".

The central factual dispute is whether customer wallets were touched. Mercado Bitcoin says customer funds were not accessed. Several blockchain security experts dispute that, showing blockchain evidence that the hackers siphoned funds from some customer wallets. Public reporting does not name those experts, publish the underlying wallet analysis, or reconcile the two positions. Treat the "no customer harm" claim as the operator's own statement, not an established fact.

No initial access vector, exploited component, CVE, malware, persistence mechanism, command-and-control infrastructure or lateral movement is described in public reporting. The destination addresses Mercado Bitcoin shared are not reproduced here: the source does not print them, and they would be live on-chain indicators in any case.

Context, not attribution. The article notes the Mercado Bitcoin incident came days after $6.3 billion was stolen from Binance, which the FBI and U.S. Secret Service blamed on North Korean hackers. That is a separate event with a separate victim; nothing in the reporting links the two intrusions or attributes the Mercado Bitcoin theft to the same actor. The article also notes that Chainalysis disclosed its own cyber incident the previous week, in which attackers used AI-backed tools to reach internal systems and took user IDs, names, email addresses and organisation role labels. That is a third, unrelated event and contributes no indicators to this advisory.

## 4\. Mitigation & containment

No fixed release, patch or vendor remediation is named in public reporting, because no vulnerable product or component has been identified. The steps below address counterparty and custody exposure, which is what this incident actually implicates.

P1, within 24 hours:

- Identify every account, custody arrangement and liquidity route with exposure to Mercado Bitcoin and confirm whether deposits and withdrawals remain suspended before executing any settlement instruction against the platform.
- Treat Mercado Bitcoin's statement that customer funds were not accessed as unverified. Do not rely on it for client-asset attestation or for any representation to a regulator or auditor until the platform publishes reconciled wallet data.
- Where your firm holds client crypto assets on the platform, obtain a written position from Mercado Bitcoin on which wallets were affected and reconcile it against your own records of client balances.

P2, within 72 hours:

- Screen on-chain flows against the destination addresses Mercado Bitcoin published, using your blockchain analytics provider, and flag any inbound transfer from those addresses to firm-controlled wallets.
- Confirm with your blockchain analytics vendor whether the frozen amounts (about $4.5 million by Tether, $2 million by other platforms) touch any address your firm controls or transacts with.

P3, within 7 days:

- Review third-party contractual provisions covering custody and settlement with crypto venues, specifically the allocation of loss when a venue's own statement of customer impact is disputed.
- Add venue-incident suspension events to the counterparty risk register so that a deposit/withdrawal freeze triggers a documented exposure check rather than an ad hoc one.

## 5\. Indicators of compromise

No indicators of compromise available in the source material.

The only pivotable artefacts in the reporting are the destination wallet addresses Mercado Bitcoin shared; the source does not print them, so none can be reproduced. The frozen-fund figures and the platform name are not indicators.

## 6\. Detection

Insufficient indicators to author detection rules.

## Threat actor context

**Lazarus Group** · [G0032](https://attack.mitre.org/groups/G0032?ref=f4n6.co.uk) · aka Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY

[Lazarus Group](https://attack.mitre.org/groups/G0032?ref=f4n6.co.uk) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [Lazarus Group](https://attack.mitre.org/groups/G0032?ref=f4n6.co.uk) has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. …

## 7\. Sources

- The Record (Recorded Future), "Largest crypto exchange in Brazil confirms cyberattack as millions flow out of platform", https://therecord.media/mercado-bitcoin-brazil-cryptocurrency-heist, 2026-11-02.
- The Record (Recorded Future), "Binance hit by record $6.3 billion crypto hack, scrambles to freeze funds", https://therecord.media/binance-hit-by-record-6-billion-crypto-hack. Separate event; no date given in the supplied text.

## 8\. Adverse Trace position

Adverse Trace assesses this as a low-severity item for EMEA financial services clients. The loss is large in absolute terms but the reporting gives no access vector, no malware, no CVE and no named actor, and the only attribution in the article (North Korean hackers, per the FBI and U.S. Secret Service) belongs to the separate Binance heist, not to Mercado Bitcoin. The claim that customer funds were untouched is single-sourced to the operator and is disputed by blockchain analysts the article does not name; treat it as unconfirmed. We will monitor for a Mercado Bitcoin post-mortem or a Chainalysis write-up that names the access vector or publishes the destination addresses, and will reissue this advisory if either appears. Clients with custody or liquidity exposure to the platform should complete the P1 exposure check before relying on any statement about customer fund safety.

---

[Read the original source →](https://therecord.media/mercado-bitcoin-brazil-cryptocurrency-heist?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*