Mercado Bitcoin wallets keep moving funds after $46M hack

Mercado Bitcoin, one of Brazil’s largest Bitcoin exchange, has confirmed a security incident that saw over $46 million worth of cryptocurrency drained from wallets on Monday. Despite the company’s announcement that deposits and withdrawals had been suspended, addresses associated with the incident continued to receive funds for hours afterward.

Security firms have stated the hack was carried out through standard transfers, rather than a smart contract exploit. 

Senior security engineer at Certik, Dickson Wu published an initial post mortem of the incident, stating that the attackers “picked at eight small chains for four hours,” including Base, Optimism and Arbitrum. The attack then moved to the company’s main hot wallets before transferring tiny amounts of Ether (ETH) from 27,160 different addresses.

“So whoever did this can also move money out of MB’s customer deposit addresses,” he wrote.

Funds move despite suspension

Hours after Mercado Bitcoin announced a temporary suspension of deposits and withdrawals, funds continued to move out of addresses tied to the breach, followed by thousands of small ETH transfers into a single address.

A spokesperson for Mercado Bitcoin told Cointelegraph that customers had suffered no losses and no data had been leaked, but the company did not respond to requests for comment on the continued transfers. A data breach could also trigger notification requirements to Brazil’s data protection authority.