Incident detected November 2, 2026 · Withdrawals remain suspended · Investigation ongoing
Key Points
- Brazil’s Mercado Bitcoin, which has 4.8 million customers, detected a security incident early Monday, November 2, 2026, and immediately suspended deposits and withdrawals.
- The exchange says approximately $38 million in assets were affected. On-chain researchers at Hypernative flagged over $40 million in suspicious transfers; Arkham tagged a “Mercado Bitcoin Hacker” entity holding roughly $46.5 million across 61 addresses.
- $11 million has been frozen with help from Tether, Circle, Paxos, BRL1, and blockchain analytics firm Chainalysis. The exchange says more freezes are in progress.
- Funds moved across at least 10 blockchains including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain, and Stellar, with over 200 token types involved.
- The transfers carried valid signatures, meaning the attacker had signing access to internal systems, not a smart contract exploit. The attack vector has not been publicly disclosed.
- The exchange says no customer assets were lost and no data was leaked. Services will resume only after security is fully restored. No reopening date has been given.
Mercado Bitcoin is Brazil’s largest crypto exchange. On the morning of November 2, 2026, it detected unauthorized activity in one of its internal systems, moved immediately to halt deposits and withdrawals, and began coordinating with blockchain analytics firms and stablecoin issuers to trace and freeze the outflows. By the time the exchange made its first public statement, $11 million had already been blocked.
What Happened: Verified Timeline
| Time (UTC, Nov 2) | Event | Source |
|---|---|---|
| ~02:15 | Bitcoin funds begin moving from Mercado Bitcoin deposit addresses to attacker-controlled wallets | Hypernative |
| 06:19 to 06:53 | Main outflow window (34 minutes). Majority of the $38M+ transferred across 10+ chains | Hypernative |
| Early morning | Mercado Bitcoin detects and contains the incident. Deposits and withdrawals suspended | Mercado Bitcoin |
| Same day | Exchange publishes 5 destination addresses (EVM, Bitcoin, Solana, Stellar, Tron) to aid on-chain tracing | Mercado Bitcoin |
| Nov 2, afternoon | $11M frozen with Tether, Circle, Paxos, BRL1, and Chainalysis. Additional freezes identified and in progress | Mercado Bitcoin |
| Nov 3, 2026 | Withdrawals and deposits remain suspended. No reopening date announced. Investigation continues | Mercado Bitcoin |
How the Attack Worked
Mercado Bitcoin has not publicly disclosed the attack vector. What the on-chain evidence does confirm is the nature of the transfers: they carried valid cryptographic signatures. This is the critical detail. A smart contract exploit forces code to misbehave. What happened here is different: the attacker obtained legitimate signing authority over the exchange’s wallets, which means they had access to private keys or the internal systems that hold them.
The transactions looked, to the blockchain, like normal outflows. Blockchain security firm Hypernative identified over $40 million in suspicious transfers across at least 10 chains before the exchange’s own announcement. Arkham Intelligence tagged a “Mercado Bitcoin Hacker” entity consolidating funds across 61 separate addresses.
Attack Flow: What the On-Chain Data Shows
How $11M Was Frozen in Hours
The speed of the freeze response is the most operationally notable part of this incident. Stablecoin issuers Tether, Circle, and Paxos, along with Brazilian stablecoin issuer BRL1 and analytics firm Chainalysis, were able to identify and blacklist attacker-controlled addresses holding their tokens within hours of the transfers occurring.
Tether alone froze over 4.5 million USDT linked to the incident. The total across all partners reached $11 million. Mercado Bitcoin says it has identified additional assets that can be frozen and those efforts are continuing, suggesting the final recovered figure will be higher.
Freeze Partners Confirmed
Current Status
As of November 3, 2026, deposits and withdrawals remain suspended. The exchange has not set a reopening date and has said services will resume only after security is fully restored, with updates through official channels. The exchange’s 4.8 million customers have been told they will not lose assets, with Mercado Bitcoin absorbing the loss.
No attacker has been identified. The attack vector remains undisclosed. Authorities are involved but no law enforcement statement has been published. The gap between the exchange’s $38 million figure and Arkham’s $46.5 million estimate has not been resolved, and it is not yet confirmed whether any frozen funds will be legally returned to the exchange.
“We want to assure our 4.8 million customers that no user assets have been lost and no personal data was exposed. We are working to restore services as quickly and safely as possible.”
Mercado Bitcoin | Official Statement, November 2, 2026
Frequently Asked Questions
Did Mercado Bitcoin get hacked?
Yes. The exchange confirmed a security incident on November 2, 2026 that resulted in approximately $38 million in assets leaving its systems. The attacker had valid signing access, meaning the transfers were cryptographically authorized, not a smart contract exploit. The exchange has not disclosed which internal system was compromised.
Will Mercado Bitcoin users get their money back?
The exchange says no customer assets were affected and all users will be made whole. Mercado Bitcoin has stated it is absorbing the loss itself. Whether this holds depends on the final scope of the damage and the exchange’s financial position, which has not been disclosed.
Why did Tether and Circle freeze funds?
Tether and Circle issue USDT and USDC respectively and maintain the ability to freeze wallet addresses holding their tokens. When Mercado Bitcoin shared the attacker’s wallet addresses, these issuers blacklisted them, preventing the hacker from moving or spending those stablecoin balances. Tether froze over 4.5 million USDT. Circle, Paxos, and BRL1 followed with additional freezes. The total reached $11 million.
Why is the hacked amount reported differently ($38M vs $40M vs $46.5M)?
$38 million is Mercado Bitcoin’s own figure for assets affected. $40 million is blockchain security firm Hypernative’s estimate from suspicious transfers it detected across 10+ chains. $46.5 million is Arkham Intelligence’s figure for the total held across 61 attacker-linked addresses, which may include funds consolidated from earlier. These figures measure different things and are not contradictory.
When will Mercado Bitcoin reopen withdrawals?
No date has been given. The exchange has said deposits and withdrawals will resume only after security is fully restored, and it will announce the timing through official channels only. As of November 3, 2026 both remain suspended.
Further Reading
The largest crypto exchange hack in history, three days before this incident. Also involved stablecoin freezes as part of the response.
Why Ethereum’s founder is moving away from browser-based interfaces and toward local, serverless tools for on-chain operations.
Sources: Mercado Bitcoin official statement; Hypernative on-chain analysis; Arkham Intelligence; KuCoin Flash; TokenPost; CyberSecurity News; AirdropAlert; crypto.news | Published November 3, 2026 | CryptoNewsBytes.com | Not financial advice.
