Brazil's Mercado Bitcoin Loses About $38 Million From Hot Wallets as ACryptoS and Ankr Suffer Smaller Exploits

Mercado Bitcoin (centralized exchange, about $38 million). Brazil's largest crypto exchange said attackers took about $38 million from hot wallets on November 2, across at least 10 blockchains. Cold storage was not affected. The company told Bloomberg Línea that customers will not bear the loss. A later update from its help center put affected assets at about $36.3 million, of which $12.9 million had been blocked with Tether, Circle, Paxos, the issuer of the Brazilian-real stablecoin BRL1, and Chainalysis, according to Cointelegraph. Some trackers estimate up to $49 million, a gap that probably reflects how assets spread across many chains are priced. Mercado Bitcoin has not disclosed how the attackers gained access to its signing keys.

ACryptoS (yield aggregator, about $665,000). On November 8, an attacker drained 77 vaults on five chains. The cause was a logic bug in share accounting. The vaults did not validate inputs, so a very small deposit minted most of the treasury's shares. The team disabled deposits, kept withdrawals open, offered the attacker a 10% bounty to return the funds, and said it will cease operations.

Ankr Ethereum bridge (about $292,000 to $304,000). Blockaid flagged the exploit on November 9 while it was still in progress. The attacker reused one legitimate Optimism transaction from November 3, so the bridge credited the same cross-chain deposit more than once. The Crypto Times describes it as a drain using forged receipts. This is a replay failure in proof validation: the bridge did not record that the receipt had already been spent.

Initia (layer-1 network and its rollups, about $2.6 million). Initia halted its chain on October 23 after an attacker minted unbacked tokens through a flawed function written in Move, its smart-contract language, and swapped them for assets on Ethereum. One linked address moved about 1,135 ETH. The network came back online on November 2, and Cryptopolitan reports that the Initia Foundation covered the losses. One analyst blames a bug in the code that connects Initia's MoveVM smart-contract environment to its Cosmos SDK base, but Initia has not confirmed this. Rekt News has published a write-up.

Smaller incidents. SlowMist logged about $112,300 lost from the InsurancePool and CoreVault contracts on BNB Smart Chain on November 3. BitMart lost about $391,000 from hot wallets on Base, Arbitrum and Optimism.