USD
Four Crypto Attacks Drain Over $146M Days After Binance Hack
Mercado Bitcoin, an EU entity, BTCPay merchants and DeFi sites were hit from Friday to Monday
TL;DR
- Four separate crypto attacks drained more than $146 million by early estimates, excluding an untallied amount taken from BTCPay merchants.
- Mercado Bitcoin suspended deposits and withdrawals, while a separate EU-linked theft saw stablecoins rapidly converted into Monero.
- Outdated BTCPay Server installations and a dozen DeFi websites registered with Name.com were also targeted.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
Four separate crypto security incidents hit between Friday and Monday, draining more than $146 million by early estimates from Mercado Bitcoin, an unnamed European Union entity and users of compromised DeFi websites, while losses from attacks on BTCPay Server merchants remained untallied. The incidents came days after Binance suffered the so-called largest crypto theft on record.
The Binance breach occurred on Oct. 29, when $6.3 billion was taken from the exchange’s hot wallets. Binance traced the theft to a compromised DevOps engineer’s laptop that allowed an attacker to submit unauthorized withdrawals. The exchange halted withdrawals while overhauling its withdrawal security, and about $3 billion of the stolen funds was frozen on-chain with help from blockchain partners.
Mercado Bitcoin Suspends Deposits and Withdrawals
Mercado Bitcoin, Brazil’s largest exchange, suspended deposits and withdrawals on Monday after security firm Hypernative said more than $40 million left wallets tied to the platform overnight. Mercado Bitcoin confirmed that it had identified and quickly contained a security incident affecting one of its systems early that morning. The exchange said customers suffered no losses and no customer data was leaked.
“Our teams are mobilized investigating the case, tracking the assets and coordinating measures with the competent authorities,” Mercado Bitcoin said.
Hypernative traced the transfers across at least 10 blockchains, including Bitcoin, Ethereum, Solana and Tron. The transactions appeared as normally signed transfers, meaning the affected wallets behaved as though they had authorized them. Hypernative said the way the attacker obtained signing authority remained unresolved and described its loss estimate as preliminary because it was still working to confirm that every source address involved belonged to Mercado Bitcoin.
Mercado Bitcoin later published five destination addresses tied to the incident across EVM networks, Bitcoin, Solana, Stellar and Tron. The tracked timing and balances showed the bulk of the activity concentrated within several hours.
Tether froze USDT sent to the Ethereum and Tron destinations, with both addresses listed as blacklisted on-chain. The exchange, meanwhile, said its own investigation, asset-tracing work and coordination with authorities were continuing.
EU Entity Loses Funds as Attacker Converts Stablecoins to Monero
A separate incident involved an unnamed organization based in the European Union that on-chain investigator ZachXBT said had about $106 million drained from several centralized exchange accounts. The attack occurred on Nov. 1, according to the supplied reporting. ZachXBT said the incident was not connected to the North Korean hacking group commonly associated with large crypto thefts, saying “it is NOT Lazarus Group.”
ZachXBT’s tracing showed that most of the stolen assets were USDC and USDT. The attacker converted them into Ether almost immediately before routing funds through the instant-swap services Kyrrex and WellWallet. The funds were then changed into Monero through a service identified in ZachXBT’s research as Wagyu and subsequently moved across different blockchains using cross-chain bridges. Investigators shared eleven addresses tied to the theft.
The shift into Monero materially changed the tracing path described in the supplied research. Transactions involving stablecoins and Ether could be reconstructed through their public ledgers, while Monero conceals information about senders, recipients and transferred amounts. The tracing therefore became substantially more difficult once the assets reached Monero.
BTCPay Server Tells Merchants to Shut Down Vulnerable Instances
BTCPay Server separately warned operators on Sunday to switch off their servers after receiving reports that unauthorized attackers were sweeping hot wallets connected to installations of the self-hosted Bitcoin payment software.
“We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers,” the project said at 5:25 p.m. ET. “If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.”
BTCPay founder Nicolas Dorier said about two hours later that the reports appeared to involve releases older than version 2.4.2 and that the attacker had logged into affected servers with administrator access. BTCPay later said its investigation had identified an attack vector targeting installations running version 2.4.1, released July 23, or earlier. Bitcoin and Litecoin were reportedly taken from hot wallets on the outdated installations, while no aggregate loss figure had been established.
“We have no credible reports of hot wallet drains for users running the latest 2.4.7 release,” BTCPay said.
The project urged operators to keep their software updated and asked affected users to provide logs and other details to its security team. Some hosting providers, including LunaNode, automatically shut down BTCPay instances running vulnerable software to prevent further exploitation.
Version 2.4.7 had been released Thursday as an emergency update addressing one critical vulnerability and several medium-severity vulnerabilities found by Anthropic’s scanner. Because BTCPay is self-hosted, merchants operate the software on their own servers rather than through a central operator. Its hot-wallet configuration keeps a wallet seed on an internet-connected server so transactions can be signed automatically.
DeFi Websites Redirected to Step Drainer
A fourth attack affected a dozen DeFi websites registered through Name.com late Friday, including Kintsu and Origami. The compromised websites were redirected to a wallet drainer, with about $138,000 traced as stolen.
Blockaid identified the malicious software as Step Drainer, a malware kit designed to trick visitors into signing transactions that transfer away their funds. Ten of the affected domains were subsequently suspended.
The four incidents involved different targets and attack paths: exchange-linked wallets at Mercado Bitcoin, centralized exchange accounts belonging to the EU entity, outdated self-hosted BTCPay Server installations and compromised DeFi domains. The reported loss total above excludes the BTCPay theft because no aggregate amount had been established for affected merchants.
This article has been refined and enhanced by ChatGPT.
