Analyst access →

Custody Risk Dominates as Mercado Bitcoin Breach Extends Exchange Security Stress

A $46 million Mercado Bitcoin breach and sustained Binance outflows keep custody resilience in focus, while Hong Kong advances 24/7 tokenized deposit settlement and New Jersey clears Coinbase staking’s return.

Mercado Bitcoin, Brazil’s largest crypto exchange, halted deposits and withdrawals after a security incident, with on-chain tracking placing assets held by the attacker at about $46 million across 36 addresses. Subsequent transfers included 2,800 ETH, 2.24 million USDC, and 1.7 million TRX, while Tether froze more than $4.5 million in USDT; the exchange stated that customers had suffered no losses but provided neither a reopening timetable nor a confirmed loss total.

The breach extends a sector-wide custody and operational-resilience test beyond Binance, with customer access dependent on both exchange recovery processes and issuer-level asset controls. It also illustrates the limits of post-incident transparency: on-chain movements and blacklist actions are observable, but the ownership of affected balances, the scale of liabilities, and the eventual customer impact remain unverified. Bitcoin traded at $76,711, down 2.06% over 24 hours, while Ether fell 1.22% to $2,250.47, though the supplied data do not establish that these price moves were caused by the Mercado incident.

Binance’s withdrawal restart continued to produce material redemptions, with reported daily net outflows of $5.14 billion and weekly net outflows approaching $14 billion, even as the exchange stated that it had replenished 95% of assets lost in the earlier breach and published a proof-of-reserves snapshot for major assets. This shifts the relevant market-structure focus from stated reimbursement capacity to sustained liquidity management under live withdrawals; the scale and duration of further outflows, along with the complete coverage of all platform liabilities, remain uncertain.

Standard Chartered launched 24/7 tokenized deposits in Hong Kong, reporting live tokenized-deposit and money-market-fund transactions involving China AMC, Finloop, and PantherTrade. Separately, the Hong Kong Monetary Authority plans to test regulated stablecoins within tokenized government debt trials, while HSBC stated that its RedCoin stablecoin has reached 50,000 users. These developments broaden the institutional settlement stack from tokenized securities toward continuous commercial-bank money movement, but commercial scale, cross-system interoperability, and the definitive terms of future stablecoin trials remain unresolved.

New Jersey rescinded its Coinbase staking order and withdrew a proposed $5 million penalty, clearing the way for Coinbase to restore staking access for customers in the state. The withdrawal removes a specific state-level operational constraint on exchange-distributed staking and improves regional product access consistency, though it does not resolve broader federal regulatory ambiguity surrounding staking services or establish a nationwide precedent.