Mercado Bitcoin halts withdrawals after $40M security breach
Brazil’s largest domestic cryptocurrency exchange, Mercado Bitcoin, abruptly halted all customer deposits and withdrawals on November 2, 2026, after identifying a major security breach. The incident involves suspicious transfers totaling more than $40 million, according to estimates from blockchain security firm Hypernative, which first flagged the unusual activity. Mercado Bitcoin halts withdrawals as a direct result of this breach.
In an official statement, the São Paulo-based exchange confirmed it had “identified and quickly contained a security incident” and stressed that “there was no loss to clients.” Mercado Bitcoin (MB) has pledged to absorb all financial losses from the event. The company has not provided a timeline for when normal operations will resume.
Mercado Bitcoin halts and the immediate response
The security breach unfolded overnight in Brazil. The first suspicious transactions were reportedly observed around 11 PM local time on Sunday, November 1, with blockchain security firm Hypernative flagging the unauthorized movements to newly created wallets early Monday morning. In response, Mercado Bitcoin suspended platform functions as a “preventive protection measure.”
In a translated post on the social media platform X, the company sought to reassure its users. “We stress that: • There was no loss to clients; • There was no data leak,” the statement read. “Our teams are mobilized investigating the case, tracing the assets and coordinating measures with the competent authorities.”
The incident comes just days after a colossal $6.3 billion Binance hack that shook the digital asset industry.
Details on how the attacker gained access remain unclear. It is not yet known whether the breach involved compromised private keys, a flaw in the exchange’s internal signing infrastructure, or the theft of employee credentials. The exchange has begun publishing the destination wallet addresses associated with the incident to aid in tracking the funds.
Tracking stolen funds across multiple blockchains
While Mercado Bitcoin has not confirmed the total value of the assets moved, on-chain analysts are painting a detailed picture of the losses. Hypernative’s initial estimate places the figure at over $40 million. Emmett Gallic, an analyst at the blockchain intelligence firm Arkham, has claimed the losses are already over $46 million and still growing.
The attacker moved a diverse portfolio of assets across at least 10 different blockchain networks, including Bitcoin, Ethereum, Solana, and Tron. The complex nature of the exploit, spanning multiple chains, highlights a sophisticated approach designed to complicate tracking and recovery efforts. The stolen funds are reportedly being consolidated into approximately 46 newly created addresses.
According to on-chain data, the attacker’s holdings include approximately 3,680 ETH, 106 BTC, and around $8 million in various stablecoins. The haul also reportedly contains 10,700 SOL, 6.7 million XLM, 77,000 AVAX, and over 200 other types of tokens. In a swift response, Tether CEO Paolo Ardoino confirmed his company has intervened.
“Tether froze more than 4.5M USDT related to this security incident,” Ardoino stated on X, effectively blacklisting a portion of the stolen stablecoins.
A turbulent week for centralized crypto exchanges
The Mercado Bitcoin incident compounds a brutal week for investor confidence in centralized crypto platforms. It follows the record-breaking $6.3 billion hack at Binance on October 29. In that case, the FBI attributed the attack to North Korea’s notorious TraderTraitor hacking syndicate. The proximity of these two major breaches underscores the persistent and evolving threats facing the industry.
These events revive the long-standing debate over the security of centralized exchanges versus the principle of self-custody. “Once that system gets hacked, everybody’s funds can be compromised,” warned Iman Shafiei, founder of Keystone Research Group, in a recent analysis. Experts continue to advise users to move long-term holdings to private wallets to mitigate such risks.
The financial fallout from a hack often extends beyond the initial theft. Varun Datta, CEO of Truth Ventures, noted that exchanges face immense pressure from customer withdrawals following a security breach. An exchange must not only cover the stolen assets but also manage a potential bank run, testing its liquidity and operational security under extreme stress.
Mercado Bitcoin’s key role in the brazilian market
Founded in 2013, Mercado Bitcoin has grown to become a dominant force in Latin America’s digital asset market. As the region’s first crypto unicorn, it serves over 4.3 million clients and has processed billions in transaction volume. The company is led by Chairman & Co-CEO Roberto Dagnoni and has attracted significant investment.
In July 2026, the exchange raised $20 million in a Series B funding round that included notable investors like the SoftBank Latin America Fund and Tether. The investment from Tether, the issuer of the world’s largest stablecoin, makes its cooperation in freezing stolen funds particularly relevant. The exchange has been a pioneer, offering not just trading but also staking and digital fixed-income products.
However, the firm’s robust market position now faces a critical test of trust. Its ability to manage this crisis, communicate transparently with its customers, and fortify its defenses will be closely watched by users and regulators alike. Discoveries of vulnerabilities in core protocols show that no part of the ecosystem is immune to security threats, putting the onus on exchanges to build resilient systems.
Navigating Brazil’s new regulatory landscape
This hack occurs at a pivotal moment for crypto regulation in Brazil. The country recently implemented its Virtual Assets Act (Law 14,478/22), which designated the Central Bank of Brazil (BCB) as the primary supervisor for the sector. The law aims to bring legal certainty and professionalize the market, but it also introduces significant operational hurdles.
The deadline for existing crypto service providers to apply for authorization with the Central Bank was October 30, 2026, just days before the hack. Mercado Bitcoin had already secured a payment institution license from the BCB on October 19, allowing it to launch its fintech arm, MB Pay.
However, this is separate from the full authorization required to operate as a virtual-asset brokerage under the new framework.
The new rules impose hefty compliance costs, including minimum capital requirements that can exceed $2 million. This regulatory pressure is expected to drive market consolidation, pushing out smaller firms and favoring larger, well-capitalized players like Mercado Bitcoin. This incident, however, complicates that narrative, demonstrating that even the largest and most regulated domestic platforms are not immune to sophisticated attacks. The event will likely lead to heightened regulatory scrutiny as the BCB continues its authorization process over the next two years.