Mercado Bitcoin Hack
Learn about the Mercado Bitcoin hack, its impact, stolen assets, and the exchange's response to Brazil's major crypto security incident.
Mercado Bitcoin Hack Shows the Cost of Cross-Chain Custody Failures in Brazil
A withdrawal freeze with no final loss figure
On November 2, Brazil’s largest crypto exchange, Mercado Bitcoin, suspended deposits and withdrawals after detecting what it called a security incident in one of its systems. The company said it had contained the event, that customer funds were unaffected, and that no personal data had leaked. [9]
For users, the immediate cost was access. Customers could not move crypto into or out of Mercado Bitcoin while the platform investigated, traced assets, and coordinated with authorities, and the company did not publish a date for services to resume. [5]
The risk is that a halted exchange can leave you unable to settle trades, meet collateral calls, convert stablecoins, or transfer assets to self-custody. Mercado Bitcoin’s statement addresses customer losses, but it does not explain whether affected wallets held company treasury, operational float, customer deposits, or a combination.
Independent blockchain tracking points to a materially different scale from the company’s public account. Coinlab’s reconstruction estimated roughly $40 million moved without authorization across at least 10 networks, including Bitcoin, Ethereum, Solana, Tron, and other chains. [2]
The timing suggests a coordinated wallet-drain event rather than a single token or smart-contract failure. Large transfers reportedly clustered within roughly 34 minutes, between 06:19 and 06:53 UTC, before funds reached newly created addresses across multiple networks. [2]
The loss estimate is moving, and the gap matters
Mercado Bitcoin has not confirmed an amount taken. Its position remains that customers were not harmed, while outside estimates initially put suspicious transfers above $40 million and later claims placed the figure above $46 million as old deposit addresses were allegedly swept. [2][5]
That $6 million gap is not yet a settled finding. The higher estimate depends on continuing on-chain activity and analyst interpretation, while Mercado Bitcoin has not released transaction-level accounting that would show which transfers were unauthorized and who ultimately bore the loss.
The reported asset mix also makes recovery harder to assess from a distance. Addresses associated with the incident reportedly held assets including ETH, BTC, SOL, XLM, AVAX, and more than 200 other tokens, meaning liquidation risk can differ sharply by chain and token liquidity. [2]
Public wallet addresses help analysts follow funds, but they are not a post-mortem. Mercado Bitcoin shared destination addresses across Ethereum-compatible networks, Bitcoin, Solana, Stellar, and Tron, yet it has not identified the compromised system or said how attackers gained transaction-signing authority. [9]
That missing detail is the central security concern. Reports indicate the transfers were ordinary blockchain transactions, not an exploit of a smart contract, which points attention toward wallet operations, access controls, signing devices, internal approval systems, or infrastructure credentials. [2]
None of those explanations has been confirmed by Mercado Bitcoin. The evidence on the attack method is thin, and until the exchange or investigators publish a technical account, assigning the breach to a particular control failure would be speculation.
Tether freeze reports belong to a separate hack
Early coverage of the Mercado Bitcoin event repeated a claim that Tether had frozen more than $4.5 million in USDT linked to the theft. That claim has not been substantiated for this incident, and readers should not count it as a confirmed recovery action.
The available reporting on large stablecoin freezes concerns the separate October 29 attack on Binance, not Mercado Bitcoin. TechReport described Tether and Circle freezing assets during the Binance response, where investigators and issuers were tracing a vastly larger pool of stolen crypto. [6]
This distinction changes the recovery picture. A stablecoin issuer can blacklist tokens at specific addresses, but that action neither identifies the attacker nor automatically sends assets back to an exchange or its customers.
Mercado Bitcoin has not publicly stated that it received frozen USDT, recovered assets, or secured help from a stablecoin issuer. It also has not published an insurance claim, reserve deployment, or reimbursement plan beyond its statement that customers were not harmed.
For a customer deciding where to keep trading balances, that leaves a familiar but uncomfortable exposure: the exchange may say it will absorb losses, while you still cannot independently verify the affected balance sheet or the time needed to restore normal withdrawals.
A second major exchange breach in days
The Mercado Bitcoin event arrived only days after Binance disclosed an attack affecting approximately $6.3 billion in assets. The Associated Press reported that Binance characterized the event as a potential security issue, while the FBI attributed the theft to North Korea-linked TraderTraitor. [1]
Binance later began restoring withdrawals in phases, starting with bitcoin, according to CoinDesk. [7] Its recovery process illustrates the difference between a technically reopened platform and a fully explained breach, because the public still lacks a complete account of every compromised control.
There is no public evidence linking Mercado Bitcoin’s incident to Binance’s attack. The shared pattern is narrower: two major centralized exchanges faced rapid, multi-asset outflows followed by restricted withdrawals, emergency tracing, and incomplete early disclosures.
That pattern is happening now because exchange infrastructure has become wider and more interconnected. Supporting Bitcoin, Ethereum-compatible networks, Solana, Tron, Stellar, bridges, stablecoins, and hundreds of tokens can spread funds and permissions across many hot-wallet and operational systems.
The commercial appeal is obvious, since customers expect fast transfers and broad asset support. The security cost is equally clear: a weakness in one signing workflow or internal system can have consequences across chains before a platform can stop activity.
Brazil’s rules are tightening as exchanges face a reporting test
Brazil’s Central Bank has already moved toward a more formal exchange regime. Rules that took effect on February 2 require prior authorization for virtual asset service providers, capital requirements between R$10.8 million and R$37.2 million, and segregation of client assets. [3][4]
The asset-segregation requirement is particularly relevant after Mercado Bitcoin’s disclosure. If customer holdings are legally and operationally separate from company treasury and trading inventory, an exchange has a clearer path to demonstrating whether a hack touched client balances.
Daily proof-of-reserves reporting is scheduled to begin on January 1, 2027. [3][4] Proof of reserves can show assets at a point in time, but it will not by itself reveal compromised wallet credentials, undisclosed liabilities, or whether a platform can process withdrawals under stress.
Brazil also gave exchanges more time for certain external reporting requirements. Central Bank Resolution 574/2026 postponed off-exchange reporting deadlines to November 3, 2026, following industry requests for a compliance grace period. [8]
The timing puts Mercado Bitcoin’s incident close to a major compliance deadline. There is no public evidence that the postponement caused or contributed to the attack, but the overlap increases pressure on exchanges to show regulators how custody, reporting, and incident response operate in practice.
No regulator has publicly announced an enforcement action against Mercado Bitcoin over the November 2 event. The available public record also does not show changes to the exchange’s customer withdrawal limits, account-security settings, or post-incident custody architecture.
What builders should take from the incident
If you are planning an exchange, wallet program, payment service, or token project in Brazil, start with transaction authority, not with token listings. You need a clear inventory of every wallet, chain, signer, automated transfer rule, vendor integration, and emergency shutdown control.
We would prioritize separation between customer custody, company treasury, liquidity management, and fee collection. A platform that combines those functions can make reconciliation slower and public disclosures less credible when suspicious transfers begin moving across multiple chains.
Build for a withdrawal pause before you need one. That means publishing the conditions that trigger a halt, the teams authorized to approve it, how customer balances are reconciled, what communication cadence customers receive, and how normal operations are restored.
You should also plan for independent monitoring. Multiple outside analysts identified suspicious Mercado Bitcoin transfers rapidly, and that visibility can help contain damage, but it is not a substitute for controls that prevent an unauthorized signature in the first place.
Stablecoin issuer cooperation belongs in a recovery plan, not a security assumption. A freeze may work only for specific centralized tokens, only after an address is identified, and only if the issuer agrees to act under its policies or legal obligations.
For Mercado Bitcoin users, the unanswered questions remain expensive even if the exchange ultimately covers every loss. Until it provides a fuller accounting, the incident is a reminder that exchange access, settlement certainty, and custody transparency can fail at the same time.
Frequently Asked Questions
What happened in the Mercado Bitcoin hack?
On November 2, 2026, Mercado Bitcoin detected a security incident that led to the suspension of deposits and withdrawals. Unauthorized transfers totaling roughly $40 million occurred across at least 10 blockchains, including Bitcoin, Ethereum, Solana, and Tron. The exact method of attack and exploited vulnerabilities have not been publicly disclosed.
How much was stolen in the Mercado Bitcoin security incident?
Independent blockchain analysis estimates that about $40 million was transferred without authorization. Mercado Bitcoin has not confirmed the loss amount and maintains that customers did not suffer losses, leaving the true financial impact unresolved.
Did Mercado Bitcoin customers lose funds in the hack?
Mercado Bitcoin states that customers did not lose funds in the incident. However, outside estimates of unauthorized transfers suggest a significant amount moved from exchange-controlled wallets, and the distinction between company and customer assets has not been clarified.
What chains and tokens were affected by the Mercado Bitcoin hack?
The unauthorized transfers involved multiple blockchains, including Bitcoin, Ethereum, Solana, Tron, Stellar, Avalanche, and more than 200 other tokens. This broad range complicates assessing the liquidity and recovery potential of the stolen assets.
How did Mercado Bitcoin respond to the November 2026 security breach?
Mercado Bitcoin immediately suspended deposits and withdrawals to contain the incident and investigate. The company stated it had contained the event, that customer funds were unaffected, and that no personal data was leaked. No timetable for resuming services or detailed technical disclosures have been provided.
How we researched this
This article was assembled from 5 published articles, 9 cited references.
Nothing here is based on hands-on testing. Where a figure or finding appears, it belongs to the source cited beside it, and the writing says so rather than implying otherwise. Every source is listed below so you can check it.
Sources
NYSE taps Wall Street giant Broadridge to bring shareholder voting to tokenized stocks, CoinDesk
Brazil's Largest Exchange Mercado Bitcoin Halts Withdrawals After $40 Million Hack, Decrypt
Brazil’s Mercado Bitcoin Freezes Deposits and Withdrawals Due to Ongoing Security Incident, Losses Estimated Near $40 Million, Bitcoin Magazine
Brazil’s Mercado Bitcoin halts withdrawals after $40 million drained across 10 chains, CoinDesk
Binance flags 'potential security issue,' says approximately $6.3 billion impacted
Mercado Bitcoin hack explained: how ~$40M left and what we know
Mercado Bitcoin Keeps Withdrawals Suspended After Nov. 2 Security Incident | PrimeXBT
BTC news: Binance begins phased withdrawals starting with bitcoin
Related Articles
Binance $6B Hack and Its Impact on Crypto Markets
Explore the Binance $6B hack details, market impact, asset freezes, and Binance's response to this major crypto security incident.
Institutional Trends After Binance Hack
Explore institutional trends and Bitcoin market resilience after the $6.3B Binance hack, including ETF flows and custody risk management.
AI Withdrawal Risk in Crypto
Explore AI withdrawal risk in crypto and how address whitelisting and zero trust models protect your assets from fast unauthorized transfers.
South Korea Crypto Regulation and Market Updates 2026
Explore South Korea crypto regulation 2026, exchange restrictions, bitcoin-backed loans, and market risks for traders and companies.