Mercado Bitcoin Hack Freezes Trading in Brazil

November 3, 2026 MM Crypto Team

Brazil’s largest cryptocurrency exchange went dark for its users overnight, after confirming a security incident that forced it to suspend deposits and withdrawals. Mercado Bitcoin, a well-known name in Latin America’s crypto market, said there were no client losses and no data leak, but it gave no timetable for reopening. For traders who rely on the platform for daily buying, selling and transfers, that combination of reassurance and uncertainty is difficult to live with. Their funds may, on the exchange’s account, be safe, but they cannot currently move them, and they do not know when they will be able to do so again. That gap between a statement of safety and a return to normal service is where most of the anxiety in this story now sits.

The incident was first flagged by blockchain security firm Hypernative, which reported more than 40 million dollars in suspicious transfers across at least 10 chains, including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain and Stellar. Later estimates put the figure higher, and the exchange’s own figures differed again. That spread of numbers is not a minor detail. It determines how seriously the incident is judged, how much pressure regulators and users will apply, and how much money may ultimately be recovered. Until a single, audited account is published, every figure in circulation should be treated as an estimate from a particular source at a particular time, not as a confirmed loss.

What Mercado Bitcoin confirmed, and what it did not

The exchange’s public position, as reported, is narrow and careful. It confirmed a security incident overnight, suspended deposits and withdrawals, said there were no client losses and no data leak, and offered no reopening timetable. Each part of that statement matters. Confirming an incident is better than silence, and suspending deposits and withdrawals is a standard containment step that prevents further funds from entering a potentially compromised system. Saying there are no client losses is the most important reassurance for users, but it is also the claim that will be tested most closely in the days ahead, because it depends on whether the affected funds belonged to the exchange itself, to clients, or to a mixture of both. Saying there is no data leak addresses a different fear, namely that personal information was stolen alongside crypto.

The conflicting loss estimates, explained

Three different figures have circulated for the scale of the incident, and they should not be merged into a single number. Hypernative flagged more than 40 million dollars in suspicious transfers. Chainalysis later put the figure at about 49 million dollars across 17 chains, with about 10 million dollars frozen. The exchange’s own figures, as reported, were about 38 million dollars in assets involved, with 11 million dollars blocked with the help of Tether, Circle, Paxos, BRL1 and Chainalysis. A separate figure of about 46 million dollars has also appeared in coverage, adding to the confusion. Presented together, the range is roughly 40 million to 49 million dollars, with the exchange’s own involved-assets figure sitting slightly below that range. That is a wide spread, and it reflects different methods, different chain coverage and different moments in a fast-moving investigation.

Tether, Circle and the race to freeze funds

The freezing figures show how much of the response depends on centralised issuers, even in a decentralised market. Tether’s chief executive was reported to have said that more than 4.5 million USDT had been frozen. That is a substantial sum, but it is only a fraction of the total estimated movement, which underlines how quickly funds can be swapped into assets that cannot be frozen in the same way. Stablecoins issued by a central company can be frozen at the smart-contract level when the issuer cooperates with an investigation, and that tool has become a standard part of the response to large thefts. Bitcoin, Ethereum and many other assets, by contrast, cannot be frozen by any single issuer, and must instead be blocked by exchanges and other services that refuse to accept them.

A 34-minute window and plain transfers, not a smart-contract exploit

Hypernative’s account of how the funds moved adds an important technical detail. The firm described plain transfers, not a smart-contract exploit, and said it was unclear how signing access was obtained. Most of the money was reported to have moved between 06:19 and 06:53 UTC, a 34-minute window, with sweeps beginning from 02:15 UTC. That pattern points away from a complex vulnerability in a decentralised application, and towards a compromise of the keys, credentials or systems used to sign transactions on behalf of the exchange. If that account is correct, the attacker did not need to break a smart contract. They needed to gain the ability to authorise transfers that looked, to the blockchain, like legitimate movements from the exchange’s own wallets.

The attacker holdings cited by third parties

Third-party estimates of what the attacker held have also circulated, and they should be read with the same caution as the loss figures. The holdings cited were about 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and more than 200 other tokens. Those are precise-looking numbers, and precision can create a false sense of certainty. The task briefing for this article is explicit: these are third-party estimates, not exchange-confirmed figures. They may reflect wallets identified by analysts at a particular moment, but wallets change as funds are swapped, consolidated or dispersed, and a snapshot taken on one day may not match the position on the next. Readers should therefore treat the list as an indication of the breadth of assets involved, across major coins and a long tail of smaller tokens, rather than as a verified inventory of the attacker’s current holdings.

Why Brazil crypto exchange security matters beyond Brazil

Mercado Bitcoin is not a small, obscure platform. As Brazil’s largest exchange, it is a gateway for millions of users in Latin America’s largest economy, and it operates in a market where crypto adoption has grown rapidly alongside regulatory debate. An incident of this size therefore matters beyond its immediate users. It affects confidence in the Brazilian crypto market as a whole, it will be watched by regulators who are already considering how to supervise exchanges, and it will be cited by critics who argue that centralised exchanges remain the weakest link in crypto, despite years of security investment. It also matters for the global picture, because it comes days after the Binance theft and raises the question of whether the two incidents are connected, even though the exchange has not linked them.

What users should watch for next

For users of Mercado Bitcoin, the next steps are practical rather than theoretical. The first is the reopening timetable, which has not yet been given. Users should watch for an official announcement from the exchange itself, rather than relying on social-media rumours, and they should be wary of phishing messages that exploit the incident by offering fake compensation, fake support links or fake withdrawal windows. The second is a clear, audited statement of what happened, which assets were involved, and whether any client funds were affected. The third is evidence of what has changed: new key-management procedures, new approval controls, new monitoring or new insurance arrangements that would prevent a repeat. Without those three things, a return to trading will feel premature to many users, even if the platform technically reopens.

The conflicting figures, the frozen sums and the unanswered questions together leave the story in an uncertain place. Estimates range from about 40 million to about 49 million dollars, with about 10 million to 11 million dollars frozen or blocked, and the attacker’s cited holdings remain third-party estimates, not exchange-confirmed facts. The exchange says there were no client losses and no data leak, but it has not yet given a reopening date or a full account of how signing access was obtained. Until those gaps are filled, the safest summary is also the simplest: a major Brazilian exchange suffered a serious security incident, a large sum moved quickly across many chains, part of it has been frozen, and the rest of the story is still being established.

For now, the exchange’s silence on reopening is the clearest signal for users to heed. Do not trust unofficial withdrawal links, and wait for an official announcement before acting. That caution, while frustrating, is the safest course until verified details emerge. Regulators and rival exchanges will watch the next update closely, because it will shape confidence in Brazil’s crypto market.

Frequently asked questions

What happened at Mercado Bitcoin?

The exchange confirmed a security incident overnight on November 2, suspended deposits and withdrawals, and said there were no client losses and no data leak. It has not given a reopening timetable, and it has not linked the incident to the Binance hack.

How much was taken in the Mercado Bitcoin hack?

No single confirmed loss figure has been published. Hypernative flagged more than 40 million dollars, Chainalysis put it at about 49 million dollars across 17 chains, and the exchange cited about 38 million dollars in assets involved. Treat 40 million to 49 million dollars as a range of unconfirmed estimates, not one confirmed loss.

How much has been frozen so far?

About 10 million dollars was reported frozen by Chainalysis, while the exchange cited 11 million dollars blocked with Tether, Circle, Paxos, BRL1 and Chainalysis. Tether’s chief executive said more than 4.5 million USDT alone had been frozen.

Was this a smart-contract exploit?

According to Hypernative, the movement involved plain transfers, not a smart-contract exploit, and it was unclear how signing access was obtained. Most money moved in a 34-minute window between 06:19 and 06:53 UTC, with sweeps from 02:15 UTC.

Are the attacker’s cited holdings confirmed?

No. Figures such as about 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and more than 200 tokens are third-party estimates, not exchange-confirmed holdings. They indicate the breadth of assets involved, but they should not be treated as a verified inventory.

Source: Unchained

MM Crypto Analysis Web