Mercado Bitcoin halts deposits and withdrawals after $46 million crypto outflow

On November 2, 2026, Mercado Bitcoin, Brazil’s largest cryptocurrency exchange, halted all customer deposits and withdrawals. A statement from the exchange confirmed that a cybersecurity incident was identified. The exchange said it was contained in the early morning.

As of July 2026, the platform served 4.8 million users and Tether had invested $20 million in it to fund expansion into tokenization, payments, lending, and credit services. Separate reporting puts the user base at approximately 4.5 million from that same period.

Blockchain security firms reported that more than $46 million in cryptocurrency drained from Mercado Bitcoin’s wallets, mainly across Ethereum-compatible networks, Bitcoin, Solana, Stellar, and Tron. Hypernative separately flagged suspicious transfers above $40 million across at least 10 blockchains, including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain, and Stellar. The exchange did not confirm the total loss figure.

Hackers executed 27,160 micro-transfers from distinct addresses during the attack. The pattern suggests hackers gained control over customer deposit addresses, not just exchange hot wallets—internet-connected wallets used for quick withdrawals. About $20 million of the stolen money moved to new wallets, while roughly $20 million remained in incident-linked addresses, including 106 BTC.

Suspicious transactions tied to Mercado Bitcoin began around 11 PM on Sunday night in Brazil, with exchange wallets sending most of their funds to newly created addresses. The timing fits the exchange’s overnight detection account, but the exchange did not explicitly connect them.

A statement from Mercado Bitcoin confirmed that a cybersecurity incident was identified. The exchange said customer funds were not harmed. It also said no data breach occurred.

Security experts challenged the exchange’s assertion that customer funds were not accessed. They pointed to blockchain evidence indicating hackers moved funds out of some customer wallets. The disagreement leaves open questions about how much customer money attackers exposed and whether the exchange’s public statements are accurate.

The exchange’s statement does not name an attacking group or reveal how the breach happened. Investigators believe the breach involved compromised private keys or problems with transaction-signing infrastructure. The intruders made normal blockchain transfers rather than exploiting a smart contract flaw, meaning they could start or approve transactions.

Dickson Wu of CertiK said attackers first went after wallets on eight smaller blockchains such as Base, Optimism, and Arbitrum. They reached Mercado Bitcoin’s main hot wallets over several hours.

Paolo Ardoino, Tether’s chief executive, said on November 2, 2026, that Tether froze more than 4.5 million USDT connected to the incident. “Tether froze more than 4.5M USDT related to this security incident,” Ardoino said. Blocking stablecoin transfers from compromised addresses is part of the wider effort to recover stolen money.

The exchange shared destination addresses for stolen funds on Ethereum-compatible networks, Bitcoin, Solana, Stellar, and Tron to help track and recover them. Chainalysis and other blockchain security firms are tracking the stolen funds to identify, freeze, and disrupt affected assets as part of collaboration with law enforcement and crypto industry officials.

Customer deposit addresses at Mercado Bitcoin keep accepting cryptocurrency on public blockchains after the platform turns off deposits internally, which could let attackers reroute incoming funds.

Mercado Bitcoin has not confirmed whether it will absorb losses from its own reserves, and the exchange has not disclosed its capital base or reserves. The spokesperson said customers did not suffer losses and that no data leak took place. The company also did not answer questions about continued fund movements after the suspension.

This hack comes after the $6.3 billion Binance breach on October 29, 2026, which the FBI and U.S. Secret Service attributed to North Korean hackers. It also took place as exchange wallet security faced increased scrutiny following several major breaches. Orionx, a Chilean exchange backed by Tether, collapsed after a forensic audit found $7 million in missing customer assets.

Because Mercado Bitcoin suspended deposits and withdrawals, customers cannot reach their funds until it brings operations back online. The exchange has not said when that will happen.