Mercado Bitcoin’s $40M+ Security Hole: Customers Covered, Withdrawals on Ice

Mercado Bitcoin, Brazil’s largest cryptocurrency exchange, said it would cover user losses from a security incident that blockchain researchers estimated at more than $46 million, while deposits, withdrawals and trading remained suspended. The exchange first disclosed the breach on November 2, 2026, saying it had identified and contained an incident in one of its systems without causing customer losses or exposing data.

Estimates of the amount affected varied. Hypernative flagged more than $40 million in suspicious transfers across at least 10 blockchains, including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain and Stellar. Arkham traced at least $46 million, Chainalysis estimated about $49 million and Certik analysts estimated more than $49 million. Mercado Bitcoin initially described the affected assets as about $38 million, while an updated FAQ placed them at about $36.3 million, and Bitquery’s later analysis estimated $48.6 million across 11 blockchains.

Bitquery reported that 36,042 Ethereum customer deposit addresses were emptied between 9:27 a.m. and 1:56 p.m. Brazil time on November 2, nearly four hours after Mercado Bitcoin announced its containment at 9:56 a.m. Those addresses held roughly $266,000. Researchers said the transfers were authorized directly by the deposit addresses, suggesting access to private keys or a system capable of signing transactions on users’ behalf. The transfers used ordinary cryptocurrency transfers rather than a smart-contract exploit.

Stablecoin issuers and industry partners began freezing related assets. Tether CEO Paolo Ardoino said more than 4.5 million USDT had been frozen, while Tether, Circle, Paxos, BRL1 and Chainalysis helped block $11 million according to Mercado Bitcoin. By 4:42 pm UTC, Tether and Circle had frozen approximately $6.2 million, more than $15 million had been frozen with industry assistance, and about $20 million remained in newly created wallets. More than $20 million was still in associated addresses identified by Mercado Bitcoin, including all 106 BTC.

The exchange later announced that account access would begin restoring on November 9, initially allowing customers to view balances, statements, holdings and investments through its website. Transfers, withdrawals and trading were slated for later phases subject to independent security testing. Mercado Bitcoin said it would replenish affected assets with company funds and that its trading desk was preparing repurchases in domestic and international markets. The incident was not publicly attributed to an organized group, and Mercado Bitcoin had not disclosed how the signing capability was obtained.