Threat watch / Attack
Mercado Bitcoin: about $38 to $46 million drained from Brazil's largest crypto exchange
On November 2, Mercado Bitcoin, Brazil's largest crypto exchange, said it had "identified and quickly contained a security incident in one of our systems" and suspended deposits and withdrawals. Blockchain analysts counted more than $46 million leaving the platform; the exchange later put the total at about $38 million and says no customer will lose assets. It has not said how the attackers got in.
- Sector
- Finance
- Way in
- Not public yet
- Product or vendor
- None named
- How it happened
- Not public yet Checked 9 Nov 2026
- What was stolen
- Crypto assets moved out of the exchange across at least 10 blockchains: more than $46 million according to blockchain security firms and Arkham data, more than $40 million according to Hypernative, about $38 million according to Mercado Bitcoin's own later update. The exchange says no customer data was breached.[1][2][3][4] Checked 9 Nov 2026
- Who was impacted
- Mercado Bitcoin's users, who could not deposit or withdraw while operations were suspended. The exchange says customers will not lose assets; blockchain analysts quoted by The Record and The Block say funds were swept from some customer deposit addresses.[1][2][4] Checked 9 Nov 2026
- Threat actor
- Not attributed. No attribution. Decrypt notes the exchange has not said who is behind the attack, nor linked it to the Binance heist of October 29.
Timeline
- Early in the morning, attackers drain funds from the exchange. Mercado Bitcoin says it "identified and quickly contained a security incident in one of our systems" and suspends deposits and withdrawals. [1][3][4]
- Blockchain analysts estimate the outflows at more than $46 million (Arkham) and more than $40 million across at least 10 blockchains (Hypernative). Tether's CEO says more than 4.5 million USDT has been frozen. [1][2][3]
- Mercado Bitcoin puts the total at about $38 million, says $11 million has been blocked with Tether, Circle, Paxos, BRL1 and Chainalysis, and repeats that users will not lose assets. Operations remain suspended with no reopening date. [4]