Mentioned in This Article
1. What do we know about the Mercado Bitcoin hack?
Mercado Bitcoin, the largest cryptocurrency exchange in Brazil, said on November 3 that customers will not pay for the hack it suffered a day earlier. The platform detected a breach early on November 2, froze deposits and withdrawals, and now describes the losses as its own responsibility. The Mercado Bitcoin hack removed tens of millions of dollars in digital assets, with estimates ranging from about $38 million to about $49 million depending on who is counting.
The exchange has given no restart date for deposits and withdrawals. It says it will post updates on X and resume normal service once full security has been restored.
The pledge matters because of how exchanges hold funds. A platform that keeps customer coins in its own wallets is in a position comparable to a bank holding cash. When thieves drain those wallets, customers can face a long wait to learn how much they will recover, if anything. A clear promise to cover the loss therefore answers the question users ask first.
2. What happened on November 2?
According to the exchange, its systems detected the incident early on November 2. As a precaution, it suspended deposits and withdrawals. In a statement written in Portuguese and posted on X, the company said it had quickly contained a security incident and that the suspension was temporary.
The same statement said customer assets are secure and that balances remain recorded. The company reported that it had activated its security and governance protocols and had notified the authorities. It also stated that no customer lost money and that no data was leaked.
What the exchange has not done is explain how the attackers got in. It has not described the technical method, the wallets involved or the time it took to contain the breach. Those details usually emerge from a forensic review, and until they are published the public must rely on the company's account and on the blockchain records that outside analysts can examine.
3. How large was the theft?
Loss figures differ because each party counts in a different way. The exchange puts the value of the assets involved at about $38 million. Security firm Hypernative flagged more than $40 million in suspicious transfers spread across at least 10 blockchains, including Bitcoin, Ethereum, Solana and Tron. Arkham, a blockchain analytics firm, traced at least $46 million. Chainalysis, another analytics provider, estimates the total at about $49 million.
The exchange has not said whether its $38 million number already includes the portion that has been frozen. That uncertainty is one reason the range is wide. Figures can also diverge when firms value tokens at different times or include different sets of addresses in their tracing.
Because the sources disagree, the safest summary is that the amount is tens of millions of dollars and that the exchange's own estimate sits at the low end of the outside calculations. The final number will probably become clearer once the company completes its own accounting.
4. How much has been frozen so far?
The exchange says it worked with the wider crypto community and with partners, including Tether, Circle, Paxos, BRL1 and Chainalysis, and that it has blocked $11 million. Chainalysis, in its own estimate, says almost $10 million has been frozen. The two figures are not identical, and the company has not reconciled them in public.
Tether, the issuer of the USDT stablecoin, froze more than $4.5 million in USDT linked to the incident. Its chief executive, Paolo Ardoino, announced the action on X. A stablecoin is a token designed to track the value of a currency such as the U.S. dollar, and its issuer can, in some cases, block specific addresses from moving the token.
A freeze does not return funds to their owner. It stops the tokens from being sent onward, which limits what the thieves can cash out, but recovery still requires additional steps. That distinction is the reason the exchange's promise to compensate customers carries more weight than the freezes alone.
5. Is there a link to the Binance theft?
The breach came days after a far larger event. On October 29, hackers drained more than $6 billion from Binance, the world's largest exchange by trading volume. The FBI attributed that attack to TraderTraitor, a hacking group tied to North Korea. Mercado Bitcoin has not connected its own incident to that attack, and nothing in the exchange's statements suggests a common perpetrator.
The timing nonetheless puts security at the center of the conversation about centralized exchanges. Two significant breaches within a week raise questions about how platforms safeguard private keys, how they monitor outgoing transfers and how quickly they can halt withdrawals when something is wrong.
Binance made a similar commitment to customers. Its chief executive, Richard Teng, said on X that Binance would absorb the financial impact of the stolen funds and that about 95% of the affected assets had been replenished. Mercado Bitcoin's response follows the same pattern, in which the platform, not the user, carries the loss.
6. How do exchange custody and tracing work?
Centralized exchanges keep customer assets in wallets that the operator controls. Users see a balance on their account page, but the underlying coins sit in addresses managed by the company, usually split between wallets that are connected to the internet for fast withdrawals and wallets kept offline for safekeeping. A breach of the keys that control either type can allow an attacker to move funds without any customer action.
Once coins leave an exchange, blockchain analytics firms such as Hypernative, Arkham and Chainalysis follow them from address to address. Public ledgers make every transfer visible, which is why several firms could publish loss estimates within a day of the incident. The difficulty lies in attribution and recovery. Thieves often split funds across many addresses and several blockchains, which is consistent with the transfers across at least 10 networks that Hypernative flagged.
Stablecoin issuers sit at a useful choke point in this process. Because they control the token contracts, they can block named addresses, as Tether did with more than $4.5 million of USDT. Assets on networks without a central issuer, such as native Bitcoin, cannot be stopped in that way, so the frozen share is likely to remain smaller than the total taken.
7. Why do loss estimates differ so widely?
The spread between $38 million and $49 million is not unusual in the early days after an exchange breach. The company that was attacked knows which of its wallets were affected, but it may be reluctant to commit to a number before its investigation ends. Outside firms see only what appears on public ledgers, so they estimate from observed transfers and from the addresses they believe belong to the exchange.
Pricing adds another variable. A portfolio that includes volatile tokens can be worth different amounts depending on the hour at which each transfer is valued. Some analysts also count assets that were moved but later frozen, while others subtract them. Without a published list of addresses, readers cannot easily reconcile the competing totals.
For customers, the significance of the range is limited if the exchange keeps its word, since the company says it will carry the loss. For the platform, however, the difference between $38 million and $49 million is about $11 million, which affects how much capital it must find to restore every account.
8. What should customers do in the meantime?
Customers cannot deposit or withdraw while the suspension lasts, so the main task is to follow the exchange's official statements and avoid unofficial messages. Incidents of this kind often attract impersonators who claim to offer faster withdrawals or recovery services, and users should treat any unsolicited request for credentials or payments with caution.
The company says no customer lost money and no data leaked, which suggests there is no immediate need to change account credentials. Even so, users who reuse passwords across services may choose to update them as a routine precaution. The exchange has not issued guidance of that kind, so this remains a general practice rather than an instruction from the platform.
Until Mercado Bitcoin publishes a reopening date, the central fact is that customers' access is paused while the company's promise to cover the losses stands. How soon that promise is converted into restored balances and open withdrawals will determine how the incident is remembered in Brazil's crypto market.
9. Can the refund pledge be verified?
Neither promise can be checked independently at this stage. A pledge to cover losses is only as credible as the resources behind it, and exchanges are generally not required to disclose their finances to customers. Users must therefore trust that the company has enough capital, or enough access to capital, to make everyone whole.
For customers, the practical test is simple. They want to see balances restored, withdrawals reopened and a clear account of what occurred. Until withdrawals resume, a refund promise is a statement of intent rather than a completed repayment.
Proof-of-reserves tools and third-party audits are the usual way exchanges try to demonstrate solvency, although they differ in what they cover. Mercado Bitcoin has not announced any such step in connection with this incident.
10. What happens next for users?
The immediate unknown is when the exchange will reopen. The company has set no date, and it ties the restart to a full restoration of security. Customers should expect further updates through the exchange's official channel on X.
Other open items include publication of the attack method, a final loss figure and the outcome of the efforts to freeze and recover stolen assets. Investigators and analytics firms continue to follow the funds across chains, and further freezes by stablecoin issuers remain possible if more tokens are identified.
The episode also serves as a reminder of a basic risk in crypto trading. Assets held on an exchange are in the platform's custody, and the user depends on the operator's security and solvency. Mercado Bitcoin's commitment to absorb the loss reduces the immediate worry for its customers, but the exchange will be judged on how quickly and transparently it restores service.