Mercado Bitcoin Halts Trading as “Routine” Transfers Take a $40M+ Detour 🕵️

Mercado Bitcoin, Brazil’s largest crypto exchange, confirmed a security incident early on November 2, 2026, temporarily suspending deposits and withdrawals while security teams investigated and traced affected assets. The company said, “We identified and quickly contained a security incident in one of our systems overnight,” adding that “There was no loss to clients” and “There was no data leak.” No timeline was provided for restoring the services, which remained suspended.

Blockchain security firm Hypernative flagged more than $40 million in suspicious outflows involving wallets attributed to Mercado Bitcoin across at least 10 blockchains, including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain, and Stellar. The first suspicious movements appeared around 11 PM Sunday night in Brazil. The transfers were ordinary cryptocurrency transactions signed as if authorized by the source wallets rather than an exploit targeting smart contracts, and Hypernative said it remained unclear how the signing capability was obtained. Mercado Bitcoin did not confirm the amount lost or disclose how the incident occurred.

Certik Senior Security Engineer Dickson Wu said the attackers “picked at eight small chains for four hours,” including Base, Optimism, and Arbitrum, before moving to the exchange’s main hot wallets. According to Wu, the attackers then transferred tiny amounts of ETH from 27,160 different addresses, meaning they could also move money from Mercado Bitcoin customer deposit addresses. He reported that thousands of small ETH transfers flowed into one address after the exchange announced its suspension, while other analysts estimated that more than $49 million had been drained from the exchange’s wallets.

Tether CEO Paolo Ardoino said the stablecoin issuer had frozen more than 4.5 million USDT connected to the incident, while security firms reported that approximately $6.2 million had been frozen by Tether and Circle by 4:42 pm UTC. About $20 million had moved into newly created wallets, and more than $20 million remained in addresses identified by Mercado Bitcoin, including all 106 BTC. The exchange published destination addresses on five networks—EVM chains, Bitcoin, Solana, Stellar, and Tron—so the funds could be tracked on-chain.

Mercado Bitcoin had 4.5 million users as of July, when Tether announced a $20 million investment supporting the exchange’s expansion into tokenization, payments, and credit. The incident followed reports that hackers had drained more than $6 billion from Binance on October 29 and $6.3 billion on Thursday; the FBI attributed the earlier theft to North Korea’s TraderTraitor group, and Binance said it had replenished about 95% of the affected assets. Mercado Bitcoin has not linked its incident to those attacks or identified a responsible group, and the investigation remains ongoing.