Mentioned in This Article
1. Mercado Bitcoin security incident stops deposits and withdrawals
Brazilian cryptocurrency exchange Mercado Bitcoin suspended deposits and withdrawals on Monday, November 2, 2026, after what it described as a security incident affecting one of its systems. The blockchain security firm Hypernative estimates that more than $40 million left wallets it attributes to the exchange. Mercado Bitcoin has not confirmed that figure, has not published a loss total, and says client funds were not lost.
The pause covers the two basic functions of any exchange: moving assets in and moving assets out. Freezing both is a standard containment step. It stops customers from sending new funds into an environment that may still be compromised, and it prevents further outflows while investigators work out how far the problem extends.
2. What has the exchange said about the incident?
Mercado Bitcoin addressed the situation in a post on X at 12:56 UTC on Monday. The company said it had identified the incident during the night and moved quickly to contain it. Writing in Portuguese, it stated that no clients had lost funds and that no data had been leaked.
The exchange added that its teams are investigating the event, tracing the assets involved and coordinating with the authorities. That is the full extent of its public explanation so far. The company has not used the word hack, has not said which wallets or which customers' balances were affected, and has not put a number on what moved.
Roughly 90 minutes after that statement, the exchange published a list of destination addresses linked to the movements. The addresses span EVM-compatible networks, Bitcoin, Solana, Stellar and Tron. Mercado Bitcoin said it was releasing them solely so that they could be identified and tracked, a request aimed at other exchanges, analytics firms and investigators who can flag or freeze funds that pass through them.
In a second post, the exchange said it is working to restore operations safely and will keep clients informed through its official channels. No timetable for reopening deposits and withdrawals was given.
3. How much did Hypernative say was taken?
Hypernative, a firm that monitors blockchains for suspicious activity, put the outflows from wallets it ties to Mercado Bitcoin at more than $40 million. Its alert was shared publicly by Pablo Sabbatella, founder of the security research outfit Opsek.
According to Hypernative's count, the party that received the funds now holds about 2,852 ETH, 106 BTC, 10,700 SOL and 6.7 million XLM, along with more than 200 other tokens. The assets sit in newly created addresses spread across at least 10 chains. Chains named in the alert include Ethereum, Bitcoin, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain and Stellar.
Mercado Bitcoin has not verified any of these numbers. An estimate built from on-chain observation can be incomplete in either direction: it may miss assets that have not yet moved, and it depends on correctly attributing wallets to the exchange. For that reason the $40 million figure is best read as a monitoring firm's working estimate, not an audited loss.
Token counts of this kind also move in dollar terms with market prices. A holding of 2,852 ETH, 106 BTC and 10,700 SOL changes in value every minute, so any single dollar total depends on the moment of measurement and on which of the 200-plus smaller tokens are counted and how they are priced.
4. What do the Bitcoin records show?
Public ledgers make it possible to check part of the picture independently. One of the Bitcoin addresses the exchange listed was reviewed on the Blockstream explorer at 14:58 UTC. At that point it had received about 106.07 BTC across seven transactions, with the first deposit arriving in a block timestamped 05:42 UTC.
Most of that total came from one transfer. A single payment of 104.43 BTC landed at 06:41 UTC. At the time of the review, none of the bitcoin had left the address, so the funds were sitting still rather than being passed through mixers or exchanges.
The bitcoin total of roughly 106 BTC lines up with the 106 BTC Hypernative says the recipient holds, which gives some support to the monitoring firm's attribution on at least that leg of the movement.
5. Why do plain transfers matter in this case?
Hypernative characterized the outflows as simple transfers and not the result of a smart contract exploit. The distinction is important. A smart contract exploit abuses a flaw in code that anyone can read and test, and it typically drains a protocol through its own functions. A plain transfer, by contrast, is what happens when someone holds the authority to sign transactions for a wallet and uses it.
That points the investigation toward access to signing credentials rather than a software bug. Hypernative said it remains unclear how the attacker obtained that signing access. Possibilities in incidents of this kind generally include compromised private keys, a breach of the internal systems that manage keys, or misuse of credentials, but nothing in the available reporting establishes which, if any, applies here. Mercado Bitcoin has described only a security incident in one system.
The fact that the movements crossed so many networks also fits with an actor who controlled wallets on each chain. Exchanges typically keep separate deposit and operating addresses on every network they support, so gaining control over the underlying key management would let an intruder sweep many chains at once.
6. How did the timeline unfold?
Hypernative's data suggests the activity began in the early hours of Monday. Sweeps of the exchange's Bitcoin deposit addresses started at 02:15 UTC. Deposit addresses are the individual receiving addresses assigned to customers, and exchanges ordinarily consolidate their contents into larger wallets, so sweeping them is an action an operator would normally perform.
The heaviest movement came later. Most of the funds left in a window of just 34 minutes, between 06:19 and 06:53 UTC. The compressed timing is consistent with automated tooling executing prepared transfers across several networks in quick succession.
Mercado Bitcoin's first public statement came at 12:56 UTC, more than six hours after that window closed, and it described the incident as already contained. The exchange said it had spotted the problem overnight, so the gap reflects the time between detection and public communication rather than a delay in noticing.
Taken together, the timeline describes a staged operation: preparatory sweeps first, a rapid multi-chain transfer phase second, and a containment and disclosure phase third. Hypernative's timestamps come from public blockchain data, while the exchange's account comes from its own internal detection, so the two sources describe the same night from different vantage points and should be compared once the exchange publishes a fuller account.
7. How do exchanges normally respond to a breach?
When an exchange detects unauthorized outflows, the usual first move is to stop the bleeding. Operators suspend deposits and withdrawals, rotate or retire the keys that may have been exposed, and move whatever remains into fresh wallets that the intruder cannot reach. Only after that do they begin the slower work of reconstructing what happened, which involves reviewing access logs, internal systems and the timing of every transaction.
Parallel to the internal review, exchanges typically notify law enforcement and share transaction details with blockchain analytics firms. Mercado Bitcoin's statement that it is coordinating with authorities and publishing destination addresses follows that pattern. Public address lists matter because stolen funds are hard to cash out when major platforms recognize them and refuse to process them.
Reopening is usually staged. Platforms often restore withdrawals first, then deposits, sometimes one network at a time, once they are confident the compromised pathway has been closed. The exchange has said only that it is working to restore operations safely, which is consistent with that cautious approach.
For customers, the practical effect of a pause is that balances remain recorded on the exchange but cannot be moved. The statement that no client lost money is therefore a claim about how balances are accounted for, and customers will want to see it borne out when withdrawals return.
8. Is the incident linked to the Binance theft?
The event arrives four days after the October 29 drain of billions of dollars from Binance's hot wallets. Hot wallets are the internet-connected wallets exchanges use to process routine withdrawals, which makes them the most exposed part of an exchange's custody setup.
Neither Mercado Bitcoin nor Hypernative has connected the Brazilian incident to the Binance case. Without evidence of a shared method, shared infrastructure or shared actors, the closeness in time should be treated as a coincidence of timing and not as proof of a connected campaign.
Even so, the sequence will put pressure on exchanges of all sizes to demonstrate how they protect signing keys, limit what hot wallets hold and detect unusual outflows. Customers tend to respond to such events by withdrawing funds, which is one reason a pause on withdrawals, while frustrating for users, can also be a defensive measure against a run on the platform.
9. What happens next for Mercado Bitcoin customers?
Several questions remain unanswered. The exchange has not said whose funds moved, whether they belonged to customers or to the company, or what the actual loss is. Its assertion that no clients lost money could mean that the company will absorb the damage from its own reserves, but it has not explained the mechanism, and the available reporting does not say.
Also open is when deposits and withdrawals will resume. The exchange has promised to restore services safely and to publish updates through its official channels, and those channels are where customers should look for confirmation of any timeline.
The published addresses give investigators and other platforms a starting point for tracking the funds. If the holdings remain unmoved, as the Bitcoin address was at the time of review, there is a window in which exchanges and issuers that can freeze assets might act. Whether that happens will depend on how quickly the attacker moves the assets onward and how many of the tokens involved can be frozen at all.