Mercado Bitcoin Hack: Brazil Exchange Halts Withdrawals After $40M Loss

By Nodora News · 3 November 2026

Mercado Bitcoin, Brazil's largest crypto exchange, paused deposits and withdrawals after a hack drained over $40 million across at least 10 blockchains.

Mercado Bitcoin, Brazil's largest cryptocurrency exchange, suspended all deposits and withdrawals on Monday, November 2, after a security incident in one of its systems. Blockchain security firm Hypernative flagged more than $40 million in suspicious transfers out of wallets tied to the exchange, spread across at least 10 blockchains including Bitcoin (BTC), Ethereum (ETH), Solana (SOL) and Tron (TRX). The exchange says the incident was contained, no customer lost money and no personal data leaked. It has not confirmed the $40 million figure or said when withdrawals will reopen.

Key takeaways

• Mercado Bitcoin paused deposits and withdrawals on Nov 2 after detecting an attack early that morning.
• Security firms estimate more than $40 million left exchange-linked wallets across 10 or more chains.
• Brazilian outlet Estadão reported the losses hit internet-connected hot wallets, while offline cold storage was untouched.
• Tether froze more than 4.5 million USDT linked to the incident.
• No one has been blamed, and there's no public evidence tying it to last week's record $6.3 billion Binance hack.

What happened at Mercado Bitcoin

Mercado Bitcoin said in a Portuguese-language post on X that it "identified and quickly contained" a security incident in one of its systems during the early hours of Monday. As a precaution, it switched off deposits and withdrawals while its teams investigate, trace the moved assets and work with the authorities.

On-chain data tells a fuller story. According to a report shared by Pablo Sabbatella, founder of security firm Opsek, most of the outflows happened in a roughly half-hour window between 06:19 and 06:53 UTC. Wallets on Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain, Stellar and other networks sent most of their balances to freshly created addresses.

Those were ordinary transfers, not a smart contract exploit. In plain terms, whoever moved the funds appears to have had the ability to sign transactions from the exchange's wallets. How they got that access is still unknown.

How much was taken in the Mercado Bitcoin hack

The exchange itself hasn't put a number on the losses. The estimates so far come from outside researchers:

• More than $40 million in suspicious transfers, per Hypernative's preliminary analysis.
• Around $50 million, according to Estadão's report.
• The attacker's addresses reportedly hold about 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and 77,000 AVAX, plus more than 200 other tokens, per the report Sabbatella shared.
• 4.5 million USDT frozen by Tether, confirmed by its CEO Paolo Ardoino on X.

A hot wallet is an exchange wallet that stays connected to the internet so it can process withdrawals quickly. Exchanges usually keep only a small slice of customer funds there, with the rest in offline cold wallets. That matters here: a hot wallet breach can be serious without touching the bulk of user deposits, which helps explain why Mercado Bitcoin says customers weren't harmed.

In a follow-up post, the exchange published the destination addresses it had identified on EVM chains (networks that run Ethereum-style code), Bitcoin, Solana, Stellar and Tron, so other platforms can spot the funds if they turn up.

Why this matters after the Binance hack

The timing is what's rattling people. Mercado Bitcoin was hit just four days after hackers drained about $6.3 billion from Binance on October 29, the largest crypto theft on record, which the FBI has attributed to North Korea's TraderTraitor group. You can read our coverage of that attack in Binance Hit by Record $6.3 Billion Hack and how Binance covered the losses in Binance SAFU Fund Halved After Hack.

So far there is no public evidence linking the two incidents, and the Brazilian exchange hasn't named a suspect. Still, two exchange breaches in one week put wallet security, key management and how quickly platforms can freeze activity back at the centre of the conversation.

The quick freeze by Tether also shows how stablecoin issuers have become a front line in hack response. Frozen USDT can't be spent or swapped, which limits how much of the haul the attacker can actually use.

Market reaction

The wider market barely flinched. At around 03:50 AEDT on November 3 (16:50 UTC, November 2), OKX prices showed:

• Bitcoin (BTC): about $77,520, down 0.8% in 24 hours
• Ethereum (ETH): about $2,271, roughly flat
• Solana (SOL): about $93.48, down 1.3%
• Stellar (XLM): about $0.167, down 0.4%
• Avalanche (AVAX): about $8.48, down 3.1%

A $40 million theft is small next to Binance's losses, and traders are watching bigger events this week, including the US midterm elections and Friday's jobs report. You can follow live prices on the Nodora charts page.

What to watch next

• Reopening date: Mercado Bitcoin hasn't given a timeline to restore deposits and withdrawals, but says it will keep posting updates on X.
• A confirmed loss figure: watch for the exchange to confirm or correct the $40–50 million estimates.
• How the attacker got in: an explanation of the signing-key compromise would show whether this was an insider, a stolen key or a wider systems breach.
• Where the funds go: with addresses public, any move to a mixer, bridge or another exchange should be easy to spot, and more freezes are possible.
• Attribution: investigators may eventually say whether this is linked to the Binance attack or is a separate case.

This article is for information only and isn't financial advice.

#Mercado Bitcoin #Hack #Bitcoin #Brazil #Security

This article is general information, not financial advice.