Brazil's largest crypto exchange spent Monday morning tracing funds after security firm Hypernative flagged suspicious transfers from wallets attributed to the platform. Mercado Bitcoin confirmed the attack on one of its systems, said the incident was contained and temporarily suspended deposits and withdrawals.

The outflows hit at least 10 networks, including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain and Stellar. The largest batch moved between 06:19 and 06:53 UTC, after earlier suspicious activity on Bitcoin deposit addresses from 02:15 UTC.

Addresses linked to the attacker held roughly 2,852 ETH, 106 BTC, 10.7K SOL, 6.7M XLM, 77K AVAX and 1.7M TRX, plus 200+ other tokens.

The transfers were ordinary signed transactions, not a smart contract exploit, which points to compromised signing infrastructure or exposed keys. The exchange says customers will not lose funds and no user data leaked. The $40M estimate is preliminary until all source addresses are confirmed as exchange wallets.