Mercado Bitcoin Halts Deposits and Withdrawals After Attack

Mercado Bitcoin, Brazil’s largest crypto exchange, has suspended deposits and withdrawals after a security incident overnight on 2 November, and says its clients “will not suffer any loss of assets”. In a statement on X at 12:56 GMT, the exchange said it had “identified and quickly contained a security incident in one of our systems”, that there was “no loss to clients” and “no data leak”, and that it had paused deposits and withdrawals as a precaution.

The reassurance about client funds sits next to a large number. In a later update at 23:17 GMT, the exchange said “the value of the assets involved is about US$38 million”, and that it had “already blocked US$11 million” working with “the crypto community and strategic partners, including Tether, Circle, Paxos, BRL1 and Chainalysis”. It did not say how the attackers got in, and gave no date for services to resume.

What Mercado Bitcoin has said

The exchange has given its account in Portuguese across a short thread on its official account, which is not verified on X but is the company’s established handle. Its first post framed the event as an “incident” rather than a theft, stressed that no customer data had leaked, and said teams were “tracing the assets and coordinating measures with the competent authorities”. A second post, at 14:24 GMT, published destination addresses on five networks, listed as EVM, Bitcoin, Solana, Stellar and Tron, “exclusively for identification and tracking purposes”.

By late evening the company put figures to the incident for the first time: about US$38m “involved” and US$11m “blocked”, with more “blockable amounts” identified and “containment” continuing. It repeated that customers would not bear any loss, and said any timeline for reopening would be announced “exclusively through our official channels”. No cause, entry route or attribution has been offered, and TSN has not seen one elsewhere.

Chainalysis puts the theft near $49m and helped freeze about $10m

The blockchain-analysis firm Chainalysis, one of the partners the exchange named, gave a larger figure. In a blog post on 2 November, it said the exchange “suffered a security incident that resulted in approximately $49 million in stolen funds”, with an attacker moving assets “across 17 blockchains” in waves, the biggest tranches in Bitcoin and Ethereum and smaller amounts on Base, Tron and Polygon. Chainalysis said a Mercado Bitcoin director phoned its in-country expert at about 2:30am US Eastern time, roughly 07:30 GMT, and that it then “led the blockchain intelligence response”, helping “freeze nearly $10 million”. It said it worked with Paxos, Anchorage Digital, Ripple, Circle and Tether, and that Tether alone froze “over $9 million”.

Other firms published their own estimates, each lower than Chainalysis but higher or near the exchange’s own. The on-chain tracker Arkham put the loss at about US$46m, as reported by The Defiant and The Block, while the security firm Hypernative estimated “more than $40m”, via Unchained. The spread, from about US$38m to US$49m, is normal in the first day of a hack, when analysts count different assets at different prices and some movements are still being traced. Mercado Bitcoin’s US$38m is the figure for assets it says were “involved”; it has not published a confirmed loss total, and the third-party numbers are estimates, not reconciled accounts.

Why the first hours decide how much is recovered

The gap between US$11m “blocked” and the tens of millions “involved” is the whole story of a modern exchange hack, and it turns on what kind of coin was taken. Centrally issued stablecoins such as Tether’s USDT and Circle’s USDC can be frozen by their issuers at a specific address; Bitcoin and Ether cannot. That is why Chainalysis describes racing from “Hour 0” to identify freezable assets before an attacker swaps them into harder-to-touch coins, and why the money recovered in these cases is so often a fraction of the money taken. The same pattern ran through the FBI-attributed Binance hack, where stolen stablecoins were the first thing partners tried to lock down, and it is the reverse of the problem at b14g, which is trying to claw back staked CORE through a network hard fork because no central issuer can freeze it.

For a Brazilian exchange, the compliance stakes are sharpened by speed and coordination. The usefulness of the exchange publishing destination addresses is that issuers, other exchanges and law enforcement can screen against them within hours, the same reasoning behind labelling drained wallets after the Bloom front-end attack. The weaker point, for now, is that the exchange has said nothing about how its systems were reached. Until it does, outside observers cannot judge whether this was a hot-wallet compromise, a key leak or an internal failure, and cannot gauge the risk to other platforms. The promise that no customer will lose money is credible for a large exchange that can absorb a shortfall, but it is a promise about who bears the loss, not evidence that the funds have been recovered.

What happens next is a waiting game on two fronts: how much more of the roughly US$38m to US$49m can be frozen or returned before it is laundered, and whether the exchange reopens deposits and withdrawals with a full account of the cause. The company says the timeline will come only through its official channels.

Sources

• Mercado Bitcoin on X: official statement, 2 November 2026
• Mercado Bitcoin on X: tracking addresses, 2 November 2026
• Mercado Bitcoin on X: update with figures, 2 November 2026
• Chainalysis blog: “Disrupting the Mercado Bitcoin Attack”, 2 November 2026

Related stories

• FBI Names North Korea in $6bn+ Binance Hack as Withdrawals Reopen in Phases
• Bloom Says Attackers Drained 9,408 SOL From 49 Users’ Wallets