Mercado Bitcoin Reports Cyber Intrusion After $46M Asset Outflow

Key points

• Mercado Bitcoin acknowledged a cyber intrusion affecting its exchange.
• Assets valued in excess of $46 million were transferred away from the platform.
• The attackers have not been identified and no intrusion method was disclosed.
• No CVE was cited, so the incident does not point to a publicly known software flaw.

Mercado Bitcoin has acknowledged that its exchange was compromised by parties not yet identified, and that digital assets valued in excess of $46 million were transferred away from the service. The disclosure frames the event as a cyber intrusion rather than a market move or customer error.

Customers and counterparties with balances or integrations tied to the exchange are most directly exposed. Because assets were moved off the platform, the immediate questions are how records are being reconciled, whether withdrawal controls have changed, and what process exists for affected users to seek restitution.

For K-12 IT teams, the case is a reminder that third-party financial and custodial services extend the district's risk surface even when no district system is named. The absence of a CVE does not mean absence of risk; unidentified entry vectors often point to identity, API, or operational control failures rather than a single patchable bug.

Investigators have not attributed the incident or described how the intrusion occurred. Watch for forensic updates, changes to withdrawal and key-management controls, and any guidance from the exchange about customer claims. Organizations should use the event to test vendor incident notification and account-recovery procedures.

What to do now

1. Enforce phishing-resistant MFA on all administrative, email, and financial accounts; remove SMS-only factors where possible.
2. Inventory third-party financial and custodial integrations, and confirm contractually required breach-notification timelines and contacts.
3. Rotate API keys, service credentials, and wallet-related secrets; revoke unused tokens and apply least-privilege access.
4. Add alerting for anomalous outbound transfers, new payee creation, and privilege changes, and route alerts to on-call staff.
5. Preserve logs and evidence, isolate affected accounts, and follow documented incident-response and legal notification paths.
6. Run a tabletop exercise for a vendor breach involving funds; verify escalation paths and customer communication approvals.
7. Review treasury and crypto custody policy, including segregation of duties, withdrawal approvals, and reconciliation frequency.

Original source

The Record