Mercado Bitcoin Hack Grows to $46M as Attacker Sweeps Deposit Wallets

By Nodora News · 3 November 2026

Mercado Bitcoin hack losses climb to about $46M as the attacker sweeps old customer deposit wallets, while Tether and Circle freeze roughly $6.2M.

Brazilian crypto exchange Mercado Bitcoin is now dealing with a bigger problem than first reported. Blockchain data from Arkham puts the assets taken in Monday's security incident at roughly $46.3 million, up from early estimates of about $40 million, and other analysts put the figure closer to $49 million. Security researchers say the attacker kept moving money out of addresses linked to the exchange for hours after Mercado Bitcoin paused deposits and withdrawals, including funds swept from older customer deposit addresses. Bitcoin (BTC) and Ether (ETH) were both trading slightly lower as the story developed on Monday, Nov. 2.

Key takeaways

• Arkham data puts the Mercado Bitcoin loss at about $46.3 million; some analysts estimate more than $49 million.
• The attacker swept funds from older customer deposit addresses and sold memecoins and other altcoins, according to an Arkham analyst.
• Tether and Circle had frozen about $6.2 million in stablecoins by late Monday afternoon UTC.
• Deposits and withdrawals remain paused, and the exchange says customers have not lost money and no data was leaked.
• The attack has not been attributed to any group and is not linked to the Binance hack.

Mercado Bitcoin hack: what's new since the first reports

When the breach was first spotted early on Monday, Mercado Bitcoin said it had found and quickly contained a security incident in one of its systems, and it suspended deposits and withdrawals while it investigated. Our first report on the incident, Mercado Bitcoin Hack: Brazil Exchange Halts Withdrawals After $40M Loss, covered that initial pause and the early $40 million estimate.

Since then, three things have changed:

• The estimated loss has grown. Arkham's on-chain tracking now shows about $46.3 million in assets involved, and Cointelegraph reported that analysts estimate more than $49 million.
• The movement didn't stop at the pause. Addresses tied to the incident kept receiving funds for hours after the exchange announced the suspension.
• The attacker reached customer deposit addresses. Arkham analyst Emmett Gallic said the attacker was sweeping funds from older deposit addresses, then selling memecoins and smaller altcoins.

Mercado Bitcoin also published the wallet addresses that received the funds, so security firms and other exchanges can watch and flag them.

How the attack unfolded across chains

Dickson Wu, a senior security engineer at blockchain security firm CertiK, shared an early post-mortem. In his reading, the attacker spent about four hours testing eight smaller networks, including Base, Optimism and Arbitrum, before moving on to the exchange's main hot wallets. A hot wallet is an online wallet an exchange uses to process everyday withdrawals, unlike cold storage, which is kept offline.

After that, small amounts of Ether were moved out of 27,160 different addresses and consolidated into a single address. Wu said this suggests whoever was behind the attack could also move money out of the exchange's customer deposit addresses, not just its main hot wallets.

Security firms say the theft was done through ordinary transfers rather than a smart contract bug. In plain terms, the attacker appears to have had the ability to sign transactions, which points to compromised keys or signing systems rather than flawed code.

Where the stolen money is now

According to figures cited by Cointelegraph as of 4:42 p.m. UTC on Monday:

• About $6.2 million in stablecoins had been frozen by Tether and Circle. Tether CEO Paolo Ardoino separately confirmed that more than 4.5 million USDT had been frozen.
• About $20 million had been moved into newly created wallets.
• More than $20 million was still sitting in addresses that Mercado Bitcoin had flagged, including all 106 BTC taken in the attack.

That leftover balance matters. Funds that haven't moved yet can still be traced, and if they touch a cooperating exchange or a stablecoin issuer, there is a chance they can be frozen.

Why it matters for Brazil's crypto market

Mercado Bitcoin is Brazil's largest crypto exchange and had about 4.5 million users as of July, when Tether announced a $20 million investment in the company to help it grow into tokenization, payments and credit.

A Mercado Bitcoin spokesperson told Cointelegraph that customers have not suffered any losses and that no data was leaked, which suggests the company plans to cover the shortfall itself. However, the exchange did not comment on the transfers that continued after the pause. If customer data had been exposed, Brazilian law could require the company to notify the country's data protection authority.

The incident also adds to a rough stretch for crypto security. It follows Binance's record $6.3 billion hot wallet breach last Thursday, which we covered in Binance Hit by Record $6.3 Billion Hack Linked to North Korea. There has also been a $2.65 million Polymarket exploit, a data breach at analytics firm Chainalysis, and hijacked DeFi websites that drained about $138,000. There is no evidence so far that the Mercado Bitcoin attack is connected to any of them.

Bitcoin price and market reaction

The market took the news calmly. Prices on OKX at the time of writing:

• Bitcoin (BTC): about $77,000, down 1.1% over 24 hours
• Ether (ETH): about $2,253, down 0.4%
• Solana (SOL): about $91.70, down 2.7%

A $46 million exchange hack is serious for the people and the company involved, but it is small next to the wider market, and traders are still more focused on Binance's recovery and recent ETF outflows. You can follow live prices on the Nodora charts page.

What to watch next

• A reopening date. Mercado Bitcoin has not said when deposits and withdrawals will resume.
• An official loss figure. So far, the $46 million to $49 million range comes from on-chain analysts, not the exchange.
• Further freezes. Watch whether the 106 BTC and the rest of the funds still in flagged addresses move, and whether more stablecoins get frozen.
• Attribution. Investigators have not linked the attack to any known group yet.
• A post-mortem from the exchange. A full account of how the attacker got signing access would show whether customer deposit addresses were fully exposed.

This article is for information only and is not financial advice.

#Mercado Bitcoin #Bitcoin #Crypto Hack #Brazil #Exchange Security

This article is general information, not financial advice.