Mercado Bitcoin’s $40M+ Security Mystery: Withdrawals Frozen, Funds Tracked

Mercado Bitcoin confirmed a security incident early on November 2, 2026, temporarily suspending deposits and withdrawals as the Brazil-based exchange investigated unauthorized transfers from wallets linked to the company. The exchange said no customers suffered losses and no data leaked, but it has not disclosed how the incident occurred or when services will resume.

Blockchain security firm Hypernative flagged more than $40 million in suspicious transfers across at least 10 blockchains, including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain, and Stellar. The transfers used ordinary cryptocurrency transfers signed as if authorized by the source wallets rather than exploiting a smart contract, according to Hypernative, which said it remained unclear how the signing capability was obtained. Possible private-key exposure and failures in transfer-authorizing infrastructure remain among the unresolved questions.

The size of the incident varied among blockchain analysts. Mercado Bitcoin said the assets involved were worth about $38 million and that it had blocked $11 million after working with Tether, Circle, Paxos, BRL1, and Chainalysis. Arkham traced at least $46 million, while Chainalysis estimated about $49 million, including nearly $10 million frozen at the time. The exchange did not say whether its $38 million figure included the blocked funds.

Tether CEO Paolo Ardoino said the stablecoin issuer froze more than 4.5 million USDT connected to the incident. By 4:42 pm UTC, approximately $6.2 million had been frozen by Tether and Circle. Certik senior security engineer Dickson Wu said the attackers “picked at eight small chains for four hours,” including Base, Optimism, and Arbitrum, before targeting Mercado Bitcoin’s main hot wallets and transferring tiny amounts of $ETH from 27,160 addresses. About $20 million moved into newly created wallets, while more than $20 million remained in addresses identified by Mercado Bitcoin, including all 106 $BTC.

Mercado Bitcoin published destination addresses on EVM chains, Bitcoin, Solana, Stellar, and Tron so the funds could be tracked on-chain. The exchange said it was tracing the assets and coordinating with competent authorities while continuing to post updates on X. The incident occurred days after hackers drained more than $6 billion from Binance on October 29; another report put that theft at $6.3 billion. The FBI attributed the Binance theft to North Korea’s TraderTraitor group, while Binance said it had replenished about 95% of the affected assets. Mercado Bitcoin has not linked the two incidents or attributed its own breach.

Mercado Bitcoin, which reported 4.5 million users as of July, also said customer assets remained guaranteed after Tether announced a $20 million investment supporting the exchange’s expansion into tokenization, payments, and credit. Chilean exchange Orionx, backed by Tether, announced its closure in September after a forensic audit found that more than $7 million in customer assets had moved to wallets outside its control. Deposits and withdrawals at Mercado Bitcoin remained suspended without a restart date.