Tether freezes $4.5 million as Mercado Bitcoin hacker holds $46 million in crypto

Tether has frozen more than $4.5 million in USDT linked to a security breach at Brazilian crypto exchange Mercado Bitcoin.

Tether CEO Paolo Ardoino confirmed the freeze on Nov. 2, saying the stablecoin issuer blocked more than 4.5 million USDT linked to the incident.

Notably, Tether is a major investor in the exchange. The stablecoin issuer announced a $20 million strategic investment in Mercado Bitcoin in July to support its expansion into tokenization, payments, and other digital financial services.

Meanwhile, on-chain analyst Specter reported that coordinated efforts involving security researchers and stablecoin issuers had expanded the immobilized assets to more than $9 million across nine digital assets, including USDC, PAXG, RLUSD, and others.

The intervention came as blockchain analytics firm Arkham Intelligence identified approximately $46 million in cryptocurrency held by wallets attributed to the attacker, including $8.37 million in Ethereum, $8.24 million in Bitcoin and $1.76 million in PEPE.

Earlier today, Mercado Bitcoin disclosed that it had identified and contained a security incident affecting one of its systems overnight.

The exchange temporarily suspended deposits and withdrawals while investigating suspicious asset movements but maintained that customers suffered no financial losses and that no personal information was compromised.

However, it has not disclosed the financial extent of the attack or explained whether its corporate reserves were affected.

Mercado Bitcoin subsequently published suspicious destination addresses across Bitcoin, Ethereum-compatible networks, Solana, Stellar and Tron to support tracing and potential recovery efforts.

Centralized crypto exchanges face growing wave of security breaches

The Mercado Bitcoin breach comes less than four days after hackers stole a record $6.3 billion from Binance on Oct. 29, extending a series of major attacks against centralized crypto exchanges.

Binance's incident followed a $388 million security breach at Bitget on Sept. 24, when attackers siphoned assets from the exchange's wallet infrastructure. Bitget subsequently tapped its protection fund to absorb the losses and protect customer balances.

The attacks have revived concerns about the security of centralized trading platforms, which collectively custody billions of dollars in digital assets and depend on internal systems to authorize transfers.

A similar pattern emerged in 2025, when two major exchanges suffered substantial losses within weeks of each other.

In February, Bybit lost approximately $1.5 billion after hackers manipulated the transaction approval process for one of its Ethereum cold wallets. The incident followed a $69 million hot-wallet breach at Phemex in January.

Although the incidents involved different attack methods, they exposed vulnerabilities in wallet management, transaction authorization, and the infrastructure exchanges rely on to safeguard customer assets.

The North Korean-linked TraderTraitor operation has been implicated in the two largest attacks. The FBI attributed both the Bybit and Binance thefts to North Korean hackers, demonstrating how sophisticated threat actors have repeatedly targeted centralized custodians.

However, investigators have not established any connection between those operations and the latest Mercado Bitcoin breach.