Brazilian crypto exchange Mercado Bitcoin suspended deposits and withdrawals after a security incident, while Tether froze more than $4.5 million in USDT linked to the case. Tether CEO Paolo Ardoino announced the freeze on November 2. Blockchain analysts have identified more than $9 million in restricted assets across nine tokens, but wallets associated with the attacker still held about $46 million in crypto. The exchange has not disclosed the incident’s overall financial impact.
More than $9 million in assets restricted across nine tokens
Ardoino said Tether had blocked the transfer of more than 4.5 million USDT connected to the incident. Blockchain analyst Specter said that, following coordination between security researchers and stablecoin issuers, more than $9.17 million in assets had been restricted across nine digital assets, including USDC, PAXG and RLUSD.
Blockchain data platform Arkham Intelligence identified about $46 million in crypto held by wallets attributed to the attacker. That included roughly $8.37 million in ether, $8.24 million in bitcoin and $1.76 million in PEPE. The freeze does not mean the remaining assets have been recovered, and public information has not established what happened to the rest of the funds in those wallets.
Tether is also an investor in Mercado Bitcoin. In July, the company announced a $20 million strategic investment in the exchange to support its expansion in tokenization, payments and other digital financial services. Tether’s involvement in restricting assets comes as its investee deals with the security incident.
Deposits and withdrawals remain suspended as losses are assessed
Mercado Bitcoin said the incident occurred the previous night and affected one of its systems. The exchange said it quickly contained the security issue after detecting it, then temporarily suspended deposits and withdrawals while it investigated suspicious asset movements. It said customers had not lost funds and that no personal information had been exposed, but did not disclose the amount involved or say whether its own reserves were affected.
The exchange also published suspicious receiving addresses on Bitcoin, Ethereum-compatible networks, Solana, Stellar and Tron to help track the assets and support potential recovery efforts. Its service updates did not give a timeline for reopening, and its status page continued to show some services as disrupted. The scope and duration of the suspension, and when deposits and withdrawals will resume, remain key concerns for users.
Security incidents hit several centralized exchanges
The Mercado Bitcoin incident came less than four days after Binance was attacked on October 29. The source put the assets involved in that incident at about $6.3 billion. Earlier, on September 24, Bitget suffered a security incident involving about $388 million, with the attacker moving assets from the exchange’s wallet infrastructure. Bitget later used its protection fund to cover the losses and preserve customer balances.
Other major incidents took place earlier in 2025. Bybit lost about $1.5 billion in February after attackers manipulated the transaction approval process for an Ethereum cold wallet. In January, Phemex suffered a hot-wallet security incident involving about $69 million. The attack methods differed, but the cases involved wallet management, transaction authorization or internal exchange systems.
The U.S. Federal Bureau of Investigation attributed the two largest attacks, on Bybit and Binance, to North Korean hackers and linked the activity to TraderTraitor. Investigators have not established a connection between that operation and the Mercado Bitcoin incident. For now, public information records asset freezes, balances in attacker-linked wallets and the exchange’s suspension of deposits and withdrawals, but the total losses and any impact on company reserves remain undisclosed.