Crypto’s Hack Wave Spreads Beyond Binance as Mercado Bitcoin Loses $38 Million and a Suspected $133 Million EU Theft Surfaces

The Binance hack was supposed to be the crypto security story of the month. Two days after the exchange reopened withdrawals, it has company. Brazil’s largest exchange, Mercado Bitcoin, lost tens of millions of dollars from its hot wallets on Monday, and an on-chain investigator is now tracking a suspected theft of more than $133 million from an unnamed European Union entity, with some of the money moving through accounts at Kraken, Crypto.com and OKX.

Neither incident has been tied to the $6.3 billion Binance breach, which the FBI attributed to North Korea’s TraderTraitor group. But together they show how quickly attackers, and the money they steal, are moving through the industry’s weakest points, and why any business holding digital assets on a third-party platform should be asking harder questions this week.

What happened at Mercado Bitcoin

Mercado Bitcoin confirmed a security incident early Monday, November 2, and suspended deposits and withdrawals as a precaution. In a post on X, the exchange said it had “identified and swiftly contained” the problem, that customers were not harmed, and that no data was breached, according to The Block. It also published the destination wallet addresses so blockchain security firms could track the funds.

Estimates of the loss vary. Arkham data cited by The Block put it at about $46.3 million. On Tuesday, the exchange itself said roughly $38 million was lost and that $11 million had been frozen with help from Tether, Circle and Chainalysis, CoinDesk reported. Mercado Bitcoin pledged to cover the loss so that no customer loses funds, and it temporarily suspended access to the platform while it investigates.

The mechanics are what worry security researchers. Wallets were drained across at least 10 blockchains, including Ethereum, Solana, Tron, Polygon, Arbitrum and Avalanche, through ordinary transfers rather than a smart contract exploit, according to CoinDesk. A report relayed by Opsek founder Pablo Sabbatella said the attacker held roughly 2,852 ETH, 106 BTC and 10,700 SOL among more than 200 tokens. How the attacker got signing access is still unknown.

CertiK senior security engineer Dickson Wu wrote in an initial post-mortem that the attackers “picked at eight small chains for four hours” before moving to the exchange’s main hot wallets, then sent tiny amounts of ether from 27,160 different addresses, Cointelegraph reported. His conclusion: “So whoever did this can also move money out of MB’s customer deposit addresses.” Cointelegraph also noted that addresses tied to the incident kept receiving funds for hours after the exchange announced its pause. The hack has not been attributed to any group.

A suspected $133 million theft in Europe

The second case is murkier. On Monday, pseudonymous investigator ZachXBT flagged suspicious outflows of about $106 million from an entity in the European Union that he did not name. On Tuesday he raised the figure to more than $133 million after tracing roughly $27 million in additional withdrawals from centralized exchanges, some of which happened after his first alert, according to Cointelegraph.

Analytics firm Bitquery calculated that $62.98 million in stablecoins was swapped into 27,553 ether within about four hours, and that the funds were withdrawn through accounts at Kraken, Crypto.com and OKX, CryptoTicker reported. Kraken said the incident “did not originate on the Kraken platform” and that it had restricted the accounts in question and is working with law enforcement. Crypto.com said it blocked related funds, and OKX said it was looking into the matter. No authority or company has publicly confirmed who the victim is.

The Binance backdrop

Both incidents land while the market is still digesting the Binance breach. Binance customers have withdrawn a net $4.72 billion since the exchange reopened on Sunday, and U.S. spot bitcoin ETFs lost $399 million on Monday, according to CoinDesk. The Crypto Fear & Greed Index sat at 26, in “Fear” territory, on Tuesday, The Bit Journal noted. Meanwhile, Kim Yo Jong, sister of North Korean leader Kim Jong Un, denied her country’s involvement in the Binance hack, Cointelegraph reported.

Why it matters for businesses

Hot wallet keys are the real attack surface. At Mercado Bitcoin, nothing about the blockchains themselves failed. The attacker apparently had the ability to sign transactions, which points to key management, internal systems or access controls. For any company running crypto infrastructure, the lesson is the same one traditional finance learned long ago: limit how much sits in hot wallets, split signing authority, and monitor for unusual activity on small, rarely used chains, where this attack reportedly started.

Stablecoin freezes help, but only partly. Tether and Circle stepped in quickly in both cases. Even so, the frozen amounts are a fraction of what was taken because attackers swapped stablecoins into ether or other assets that no issuer can freeze. A business treasury that assumes stolen stablecoins will be recovered is making a risky bet.

Exchanges are now part of the laundering trail. The EU case shows stolen funds passing through regulated, mainstream platforms. That raises compliance stakes for exchanges and for the businesses that use them: account freezes can catch legitimate counterparties, and regulators will expect faster cooperation.

Counterparty risk is back on the agenda. Mercado Bitcoin says it will make customers whole, and Binance says it has replaced most of its losses. Still, a withdrawal freeze of even a few days can disrupt payroll, supplier payments or trading for a company that keeps operating funds on one exchange. Spreading holdings across custodians, testing withdrawals regularly and keeping a written plan for an exchange outage are cheap insurance.

What to watch next

Key questions remain open: how the Mercado Bitcoin attacker obtained signing access, whether the EU victim will come forward, and whether any of the stolen funds can still be frozen as they move. Expect regulators in Brazil and Europe to press for answers, and expect more exchanges to publish wallet-security details as customers ask where their money actually sits.

The bottom line: the crypto market is showing it can absorb a record hack without a broader collapse, but the steady drumbeat of new breaches is a reminder that security, not price, is the risk business users can least afford to ignore.

Edited by Coron @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous