Brazil's largest exchange (Mercado) hacked for 40m $

[OmegaStarScream]

It's still unclear as to what happened. According to a security firm, there was 40M $ worth of suspicious transactions (multiple networks)[1]

At the same time, Mercado issued a statement saying that "there was no harm to users" and there was no data breach either.

Official Statement (translation by X):

We identified and swiftly contained a security incident in one of our systems early this morning.

We reiterate that:
• There was no harm to customers;
• There was no data breach.

As a precautionary measure for protection, deposits and withdrawals are temporarily suspended. Our teams are mobilized investigating the case, tracking the assets, and coordinating measures with the competent authorities.

We will keep regular updates here.

Although I'm not sure I understand the highlighted part.

Does this mean funds were lost, but it's simply going out of their pockets as opposed to the users?

[1] https://x.com/TheBlockCo/status/2117251614570688643

[sergiorus]

Although I'm not sure I understand the highlighted part.

Does this mean funds were lost, but it's simply going out of their pockets as opposed to the users?

At first I thought there was some language barrier since the tweet is originally in Portuguese, but now I think they claim no funds were lost.

So it is what it is. Despite what Hypernative claim, they seem to be denying any losses. Let's see if they end up as liars.



Mercado don't publish proof of reserves, but despite being a 13 years old exchange, their volumes are rather modest: only $2 million in the last 24 hours.

A $40 million hit could be very painful but since it is a strategically important fiat onramp/offramp service for an enormous Brazilian market, they will get bailed out if things get too ugly.

[sunsilk]

Although I'm not sure I understand the highlighted part.

Does this mean funds were lost, but it's simply going out of their pockets as opposed to the users?

Those words are to comfort users so that they won't panic. But when deposits and withdrawals have been suspended, we have an idea of what is actually happening.

This isn't the first time we've seen it happen to an exchange. And if they continue to deny that there's no funds lost from the users, well much better.

Though, are we going to believe such? or if there's no harm to user funds, this is another way of saying they'll cover the losses too.

[Orpichukwu]

Although I'm not sure I understand the highlighted part.

Does this mean funds were lost, but it's simply going out of their pockets as opposed to the users?

The statement is a bit confusing, but at the same time it’s simply saying any loss which might have happened due to the hack is on the exchange and has nothing to do with users' funds, but they should not use the statement “no harm was done to customers", as pending withdrawal will do a lot of damage to some who keep their funds on the exchange.

Another day, another hacked news, and yet people still leave their money in exchange. Not your key not your coin

[OmegaStarScream]

They just posted an update mentioning the addresses the funds were sent to. So what was originally reported by the security firm (Hypernative) was accurate. Not sure how an exchange with a trading volume this low[1] is able to swallow such an amount but let's hope users will be able to withdraw their funds.

Update:
We continue working to safely restore operations and will keep our customers informed through our official channels.

To contribute to the monitoring and tracking of assets on blockchain networks, we are sharing the destination addresses identified in the transactions related to the incident.

Identified addresses:

EVM: 0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478
BTC: 19qGpsHvzh1t6pVi526XNNkh6hW6prDZp
SOL: 3YX6WHncP1Ra4AotE9YLawFt4nPmxyux288FWXkEW97J
XLM:
GDXYRI6IONQA5YTGRLQ603FGJ2BWXPJTTQPUXFPSEXSRKBZLFKMZSOLP
TRON: TEX3HuDRHRa3tnYpy96M4UfSx62VhDyA5L
These addresses are disclosed exclusively for identification and tracking purposes.

I ran them through arkham intelligence,:

- https://arkm.com/explorer/address/0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478 (22M $)
- https://arkm.com/explorer/address/19qGpsHvzh1t6pVi526XNNkh6hW6prDZp (8M $)
- https://arkm.com/explorer/address/3YX6WHncP1Ra4AotE9YLawFt4nPmxyux288FWXkEW97J  (1.5M $)
- https://arkm.com/explorer/address/TEX3HuDRHRa3tnYpy96M4UfSx62VhDyA5L (950k $)

I couldn't really check for the XLM address in arkham, or any XLM explorer either.

[1] https://coinmarketcap.com/exchanges/mercado-bitcoin/

[mikel_012]

They just posted an update mentioning the addresses the funds were sent to. So what was originally reported by the security firm (Hypernative) was accurate. Not sure how an exchange with a trading volume this low[1] is able to swallow such an amount but let's hope users will be able to withdraw their funds.

Tether froze 4.5M USDT from this incident: https://x.com/paoloardoino/status/2117272224814219720

Mercado Bitcoin has a low volume but the fees are not low and they have a few other products like tokenized bonds of brazil companies. I think they can make money to cover what they lost because this is better than closing shop

[sergiorus]

Tether froze 4.5M USDT from this incident: https://x.com/paoloardoino/status/2117272224814219720

That still leaves a $40+ million (no one surely knows how much it was still) hole in the budget now.

Mercado Bitcoin has a low volume but the fees are not low and they have a few other products like tokenized bonds of brazil companies. I think they can make money to cover what they lost because this is better than closing shop

The fees are higher than on the most other exchanges but at $20 million a day they are not a savior.

They don't publish the revenue data but what they lost is almost definetely twice more than their yearly revenue. They will need a bailout if the funds aren't recovered. Given their strategic position on the Brazil's market and relatively modest amount of funds lost (by overall crypto standards) I think they won't have problems finding someone to bail them out. I'd bet it's gonna be a big crypto exchange.

[Cryptock]

It looks like this may not be the end of Mercado Bitcoin's problems:

"Funds move despite suspension

According to Wu, hours after Mercado Bitcoin announced a temporary suspension of deposits and withdrawals, funds continued to move out of addresses tied to the breach, followed by thousands of small ETH transfers into a single address.

A spokesperson for Mercado Bitcoin told Cointelegraph that customers had suffered no losses and no data had been leaked, but the company did not respond to requests for comment on the continued transfers."

Source: https://ct.com/news/mercado-bitcoin-hack

[Delaforetnoire]

Where even well-known top-tier exchanges get hacked, such incidents happening to these small exchanges are normal.

Still, many people keep their money in exchanges and don't know why they keep depositing money even after knowing about so many hacking incidents.

Those who still keep their money in exchanges may own a lot of money, so they don't have any headache about losing their money due to these kinds of small exchanges getting hacked.

[mikel_012]

That still leaves a $40+ million (no one surely knows how much it was still) hole in the budget now.

According to Mercado Bitcoin they froze $11 million with the help of Tether, Circle, Paxos, BRL1 and Chainalysis

They said $38 million was involved, but I did not understand if it is 38 - 11 or if it is 38 million after everything frozen. I think it is 38 - 11 which makes a loss of $27 million.

Source: https://x.com/MercadoBitcoin/status/2117395630150795543

[Darker45]

The official announcement doesn't sound urgent at all. They seem to be unbothered despite the amount being relatively big as far as their trading volume is concerned.

On another note, it's interesting that around 10 days ago, old user ThiagoCMC came back here after more than 8 years of inactivity bringing the latest updates of his/their case against Mercado, which has already been running for more than a decade.

It appears they're on the winning side considering the earlier decision of the lower court ordering Mercado to return 2,182 BTC. On appeal, a higher court upheld the decision but converted the amount to the coins' fiat equivalent in 2013. The appeal has already reached the highest appellate court in the country, questioning the decision that reduced the 2,182 BTC obligation to just around 5 BTC. The Superior Court has responded, acknowledging the controversy.

I'm not saying this is related but, putting on a tinfoil hat, the timing is a bit interesting.

While Mercado may easily survive losing $40-$49 million in a hack considering its current valuation, what's the possibility they'd rather close shop and dissolve? That would not only finally put a stop to all these trials, which they seem losing, it could also make their identity disappear and, therefore, the possibility or threat of being ordered by a final decision of the Superior Court to return 2,182 BTC.

[freedomgo]

That still leaves a $40+ million (no one surely knows how much it was still) hole in the budget now.

According to Mercado Bitcoin they froze $11 million with the help of Tether, Circle, Paxos, BRL1 and Chainalysis

They said $38 million was involved, but I did not understand if it is 38 - 11 or if it is 38 million after everything frozen. I think it is 38 - 11 which makes a loss of $27 million.

Source: https://x.com/MercadoBitcoin/status/2117395630150795543

According to the report, it was $49 million that was stolen, and that $38 million is now the amount remaining unfrozen after deducting the $11 million that was reportedly frozen. Those are the correct numbers.

Early this morning Mercado Bitcoin, Brazil’s largest crypto exchange, suffered a security incident that resulted in approximately $49 million in stolen funds. As a Chainalysis customer, Mercado Bitcoin alerted our team in the early hours of the incident. We immediately mobilised our global team of investigators to lead the blockchain intelligence response, working closely with Mercado Bitcoin, law enforcement, and industry partners to help freeze nearly $10 million in stolen funds.

[Frankolala]

Other Exchanges that haven't been hacked should see themselves as the next and check through their systems for any bug or vulnerability that these hackers can use as an advantage to exploit the bug in their system and steal their funds. They can use AI for this to search for bugs, upgrade and update their systems. They shouldn't wait till they get hacked. It seems decentralized service is more at alert on their security than this centralized service.