Mercado Bitcoin Cyberattack Leaves Losses and Customer Impact Unclear
Mercado Bitcoin says it is investigating a cyberattack and tracking assets linked to it. Reported losses and freeze totals vary, and security experts cited by The Record dispute the exchange’s assurance that customers will not lose funds.
- Reported loss estimates have not been reconciled.
- The Record reported at least $6.5 million in freezes, not a recovery total.
- Customer impact remains disputed, and the attack method is unknown.
- No supplied evidence links the incident to North Korea, AI tools, or quantum computing.
Different figures measure different things
ZyCrypto reported an initial estimate of $40 million in assets involved. It said Arkham Intelligence analyst Emmett Gallic later identified another $5 million. That could put estimates above $45 million, but the reports do not say whether the $5 million was separate from the initial estimate or explain how either figure was calculated.
ZyCrypto also reported that Mercado Bitcoin valued the affected assets at $38 million and said $11 million had been blocked with help from other firms. Those figures do not line up with the larger estimates.
The Record reported lower freeze figures: Tether CEO Paolo Ardoino said Tether froze about $4.5 million, while other platforms reportedly froze another $2 million. That comes to $6.5 million in reported freezes, not a confirmed total of funds recovered or returned to customers. The available accounts do not explain how this figure compares with the reported $11 million.
The terms matter. Tracking means monitoring where assets move on a blockchain. Freezing means restricting access to them, usually with the help of a company that can control the assets. Neither action alone means the funds have been recovered or customers reimbursed.
Chainalysis said its investigators were tracking assets to help industry participants identify, freeze, and disrupt them. That work can support a response, but it does not show how much was ultimately recovered.
Customer assurances are disputed
Mercado Bitcoin said customers would not lose assets. In an update quoted by ZyCrypto, the exchange wrote:
“Mercado Bitcoin assures you that you will not suffer any loss of assets due to the security incident we identified today on our platform.”
The Record reported that blockchain security experts challenged the company’s assessment, pointing to an Ethereum transaction they interpreted as showing funds taken from some customer wallets. The Record did not name the experts. On-chain movements can show that assets moved, but they do not establish who controlled a wallet or whether a customer ultimately lost funds.
The exchange’s assurance and the experts’ reported concerns about customer wallets both remain on the record. The available reporting does not resolve the disagreement. It also does not establish whether Mercado Bitcoin meant that customer balances were unaffected or that the company would reimburse anyone who incurred a loss.
The exchange shared destination addresses so others could monitor the funds. It said:
“To contribute to the monitoring and tracking of assets on blockchain networks, we are sharing the destination addresses identified in the transactions related to the incident.”
The Record said the company planned to restore its platform in the coming days, but did not say which services had been suspended or give a restoration date. The available accounts also do not explain how the attackers gained access. A destination address can help investigators follow funds, but it cannot show how the breach began.
Keep other attacks in their own lanes
The incident comes amid other significant crypto thefts, but the available reporting does not connect them. The FBI attributed the theft of approximately $1.5 billion from Bybit, on or about February 21, 2025, to North Korea’s TraderTraitor activity. That attribution concerns Bybit, not Mercado Bitcoin.
References to AI-backed tools and “Q-Day, ” a term for concerns that future quantum computers could threaten some forms of cryptography, do not establish a connection to this attack. The reporting presents no evidence tying either to Mercado Bitcoin.
Repeated breaches can erode confidence in crypto services, even when companies and industry partners manage to restrict some funds. Keeping assets on an exchange means relying on the company’s security and incident response. Self-custody removes that particular intermediary but leaves users responsible for protecting their private keys. Neither approach eliminates risk.
Key questions and answers
-
How much was taken?
Reports cite estimates ranging from $38 million to more than $45 million, but they have not been reconciled. A definitive loss total has not been established.
-
How much was frozen?
The Record reported that Tether froze about $4.5 million and other platforms froze another $2 million. That $6.5 million is a reported freeze figure, not proof of recovery or reimbursement.
-
Did customers lose funds?
Mercado Bitcoin said customers would not lose assets. Security experts cited by The Record challenged the company’s assessment, and the available evidence does not establish whether customers ultimately suffered losses.
-
Has the attack method been identified?
The available reporting does not explain how the attackers gained access or how they used the targeted addresses.
The next meaningful updates would be a reconciled accounting of the assets involved, a clear explanation of any customer reimbursement, and details on how the attackers got in. Until then, the reported totals remain estimates, and the exchange’s assurance has not settled the question of customer impact.
Crypto companies’ security and incident response will remain central to public confidence as the investigation develops.
