In this article5 sections
Tether has blocked more than 4.5 million USDT tied to a security incident at Brazilian exchange Mercado Bitcoin, which reported the breach on Nov. 2 and suspended deposits and withdrawals while it investigated, according to crypto.news.
Company chief executive Paolo Ardoino confirmed the freeze in a post on X while sharing the exchange’s own official statement on the breach. Mercado Bitcoin said it identified and quickly contained the incident in one of its systems early that morning, that customers were not harmed and that no data was leaked.
Also readBinance pledges to cover losses from $6.3B breach
Key facts
- Tether froze more than 4.5 million USDT linked to the Mercado Bitcoin incident, a figure Ardoino announced alongside the exchange’s statement.
- Mercado Bitcoin said the breach affected one of its systems on Nov. 2, caused no customer harm and involved no data breach.
- The exchange temporarily stopped deposits and withdrawals as a precaution while its teams tracked assets and coordinated with authorities.
- It later published destination addresses across EVM-compatible networks, Bitcoin, Solana, Stellar and Tron, describing the list as for identification and tracking only.
- Brazilian outlet BitNotícias reported that security firm Hypernative had flagged more than $40 million in suspicious transfers from wallets attributed to the exchange, spread across newly created addresses on at least 10 networks, per crypto.news.
Two measures, two different totals
The $4.5 million USDT freeze and the $40 million-plus outflow estimate describe different things. One is the amount of Tether’s dollar-pegged token blocked by its issuer; the other is a reported tally of suspicious transfers across multiple assets and networks. Ardoino’s post did not say the tokens had been returned to Mercado Bitcoin, and it did not split the frozen amount across the addresses the exchange published. Neither announcement produced a final recoverable total.
Mercado Bitcoin said its follow-up disclosure listed the addresses purely so that investigators and other market participants could follow transactions linked to the breach. The EVM entry named the address 0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478. Separate entries covered BTC, SOL, XLM and TRON, but the exchange did not attach a dollar value to any single destination or say how much of the affected assets sat on each network. It also gave no reopening time for deposits and withdrawals.
Also readBlumenthal Demands Cantor's Tether Records by Oct. 23
Binance and BTCPay incidents in the same week
As AMBCrypto reported, the freeze was the second Tether has carried out in seven days. The earlier one followed a theft at Binance, which disclosed that attackers took approximately $6.3 billion from its wallets on Oct. 29 and began reopening withdrawals on Nov. 1 while committing to cover the losses.
BTCPay Server issued its own advisory on Nov. 2 after reports that Bitcoin and Litecoin were taken from wallets whose spending keys were stored on affected servers. AMBCrypto reported that web servers running version 2.4.1 or earlier were targeted and that attackers also exploited a vulnerability patched in August through a different route. The team advised moving to fresh servers and migrating existing wallets and seeds, warning that simply updating the software could leave an opening. Wallets holding spending keys outside those servers, including most hardware wallets, were not affected.
Why it matters
Tether’s ability to lock tokens at specific addresses gives investigators a lever that most other assets lack, and it turns a private exchange investigation into a public, enforceable action. For Mercado Bitcoin’s users, the distinction is practical: the exchange says balances are intact, while money cannot move in or out of the platform. The case also lands in a Brazilian market where the central bank has been building a real-time threat monitoring and alert-sharing system with Hypernative, with Mercado Bitcoin and Foxbit among the named participants, as crypto.news reported in August. That earlier reporting did not say whether the new system fed into this incident, and the exchange’s statements did not identify which alert infrastructure was used.
What to watch
Mercado Bitcoin has said further updates will come through its official channels, so the next signal is its notice that deposits and withdrawals have reopened, alongside any detail on how much of the frozen USDT is eventually returned or released. Tether’s prior enforcement activity offers a comparison point: in an April 23 announcement it said it assisted US authorities in freezing $344 million USDT across two addresses, at a time when it reported working with more than 340 law enforcement agencies in 65 countries and more than 1,200 cases tied to US law enforcement.
This article reports facts about an ongoing investigation and is not financial advice. Crypto markets are volatile and uncertain, and the outcome of asset tracing and recovery is not known.
Sources: crypto.news, AMBCrypto
