Mercado Bitcoin hack: $11.2 million frozen, withdrawals halted and pledge to cover customer losses

São Paulo, November 3, 2026 — Mercado Bitcoin (MB), one of Brazil's largest crypto exchanges, was hacked. The main withdrawals occurred in the early hours of Monday, November 2. The attackers drained assets from the company's hot wallets (internet-connected wallets used to process withdrawals) across at least ten blockchains. The exchange suspended deposits and withdrawals. In a report updated Monday evening, CNN Brasil relayed MB's position: $11.2 million frozen and a guarantee that no customer will lose their assets. As of publication, there was no timeline for withdrawals to resume.

frozen with issuers and partners, according to MB

$11.2M

still tied to the incident, according to MB

$38M

total outflows estimated by Chainalysis

$49M

customer deposit addresses drained on Ethereum, according to Bitquery

35,853

What happened on November 2

In its initial statement, posted on X and reproduced by InfoMoney, MB said it had contained the incident and suspended deposits and withdrawals as a precaution. It also said customers had suffered no losses and no data had been leaked.

We quickly identified and contained a security incident in one of our systems in the early hours of this morning.

Mercado Bitcoin, November 2 statement reproduced by InfoMoney

The timing varies by source. According to Arkham, the attack began with a test transaction of 0.0001 ETH from MB's hot wallet on Base, and withdrawals on that network began at 1:22 a.m. UTC on November 2. In Brasília, it was 10:22 p.m. on Sunday, November 1. The large outflows came hours later. A report shared by Pablo Sabbatella, founder of security firm Opsek, and cited by CoinDesk places the largest outflows between 6:19 a.m. and 6:53 a.m. UTC, or between 3:19 a.m. and 3:53 a.m. in Brasília. Chainalysis said an MB director called the company in the early hours of the day to report the attack. Within 30 minutes, Chainalysis had provided authorities with the addresses whose balances could be frozen.

1. 11/01Evening: according to Arkham, the attacker's first transaction on Base, at 10:22 p.m. in Brasília.
2. 11/02Early morning: MB's hot wallets on at least ten networks send most of the assets to the attacker. Deposits and withdrawals are suspended.
3. 11/02Morning and early afternoon: Bitquery records customer deposit addresses being drained even after the exchange said the attack had been contained.
4. 11/02Evening: CNN Brasil relays MB's position, with $11.2 million frozen, about $38 million still tied to the incident and a guarantee that no customer will lose assets.
5. 11/03CoinDesk reports the pledge to cover losses. Arkham reports further ETH transfers by the attacker.
6. No date setResumption of deposits and withdrawals, which MB says it will announce in future updates.

How much was taken, how much was frozen and why the figures differ

In a report updated at 9:13 p.m. on November 2, CNN Brasil relayed the exchange's position: $11.2 million frozen and about $38 million still tied to the incident. Together, the two amounts total close to $49 million. According to CNN, MB says it is working with Tether, Circle, BRL1, Paxos and Chainalysis on recovery efforts. Freezing restricts the movement of assets and does not, on its own, prove that they have been returned to the exchange. Third-party estimates arrive at similar figures, using different methods and cutoff times.

The frozen-asset figures cover different scopes and points in time. Bitquery used data through 3:46 p.m. UTC on November 2 for Ethereum and between 2:16 p.m. and 3:47 p.m. UTC for the other networks. At that cutoff, it counted $5.9 million frozen by Tether and $1.5 million by Paxos. Circle had not yet frozen anything, and about $4.29 million in USDC and EURC could still be moved. Chainalysis says Tether froze more than $9 million after receiving the addresses and names Paxos, Anchorage Digital, Ripple and Circle among its partners. On November 3, CoinDesk reported $11 million frozen with help from Tether, Circle and Chainalysis. Until a consolidated accounting is available, the exchange's figure is the reference.

How the attack unfolded, according to on-chain analysis

According to the report cited by CoinDesk, the theft involved ordinary transfers, with no smart contract exploit. This indicates that the attacker was able to sign transactions on the exchange's behalf. How that access was obtained remains unknown. Bitquery calculates that the hot wallets on the ten networks paid the attacker over roughly 25 minutes, between 6:24 a.m. and 6:50 a.m. UTC (3:24 a.m. and 3:50 a.m. in Brasília). Then, at 12:10 p.m. UTC, the draining of customer deposit addresses on Ethereum began: 35,853 addresses were emptied, holding about $261,000 in total. According to Bitquery, the exchange's message saying the incident had been contained was issued at 12:56 p.m. UTC, while those addresses were being drained. Withdrawals were still taking place at 3:44 p.m. UTC.

Bitquery's hypothesis is that the attacker gained access to MB's payment system and the keys to deposit addresses, which typically derive from a master key. Bitquery itself cautions that it cannot prove this using blockchain data alone. The exchange has not explained how access was obtained. According to CoinDesk, MB disclosed the destination addresses on EVM networks, Bitcoin, Solana, Stellar and Tron to help with tracing.

On Tuesday, November 3, Arkham reported that the attacker moved about $8 million in ETH between addresses linked to the attack, according to crypto.news. Arkham raised the possibility that the Tornado Cash mixer could be used but identified no confirmed deposit. No one has claimed responsibility for the attack, and there has been no official attribution.

What the exchange promises and what remains unresolved

MB says no customer will lose assets. According to CoinDesk, the exchange said it will cover a loss of $38 million to $40 million. The promise to preserve customer assets cannot be verified through blockchain transactions alone. The cited report does not detail how that coverage will be funded or the timeline. The company says it has notified authorities without specifying which ones.

When checked on Tuesday, MB's status page showed the website, login, app, registration and Trade API as operational. The page does not list deposits or withdrawals. The exchange says it will provide a timeline for resumption in future updates through official channels.

What to do if you hold funds or have payments that depend on the exchange

1. Do not count on MB withdrawals for payments with fixed due dates. If a supplier payment depends on those funds, notify the supplier and review the schedule.
2. Follow only the exchange's official app, website and social media accounts. Screenshots and forwarded messages are no substitute for the original statement.
3. Keep statements and records of your balance and pending orders. They will help with any future reconciliation.
4. When withdrawals resume, check the destination address and track the transaction using its hash on a public explorer.

Mercado Bitcoin never asks for a password, verification code or recovery phrase.

Mercado Bitcoin, statement reproduced by CNN Brasil on November 2

How this type of fraud works is explained in fake support and crypto recovery scams. To verify a USDT transfer on the TRON network, see how to check a transaction on Tronscan. Swapo also never asks for passwords, access codes or private keys. The case also shows that stablecoin issuers can freeze balances linked to crimes, a topic we cover in T3 Financial Crime Unit.

Second attack on a major exchange in less than a week

The MB hack came just days after the Binance hack. According to CoinDesk, more than $6 billion was stolen from Binance, and the FBI attributed the attack to the North Korean group TraderTraitor. CoinDesk also reports that there is no public evidence linking the two attacks. Developments in the Binance case are covered in Binance hack: withdrawals reopen and company says it has covered 95% of losses. We will update this article when MB announces a timeline for resumption or a final accounting of what has been recovered.

• Hacks
• Exchanges
• Cybersecurity
• Scams
• USDT
• Tether
• TRON