How can I protect myself from attacks like the Mercado Bitcoin exchange hack?

Users: check an exchange's official channels for status and compensation terms, and avoid moving funds in response to unofficial messages during an incident. Users: keep only what you need to trade on exchanges, and prefer venues that publish proof of reserves and incident reports. Builders: transactions signed with valid credentials look legitimate on-chain, so protect signing keys and wallet-control infrastructure with segmentation, hardware-backed signing, withdrawal limits and anomaly alerts. Builders: small unusual transfers on minor chains, such as the reported tiny ETH transfers from 27,160 addresses, may be early warning signs and should trigger monitoring and automatic response. Builders: pre-arranged relationships with stablecoin issuers and analytics firms speed up freezes, as reportedly happened here.

Hacks & scams / Hack

55severity

HackcontainedBitcoinEthereumSolanaTron

Mercado Bitcoin exchange hack: Brazil's largest exchange Mercado Bitcoin reportedly loses $40M-$46M across 10+ chains, vows to absorb loss

Q: How much was lost in the Mercado Bitcoin exchange hack?

About $46.3M was reported lost (Reported range of about $40M (Hypernative, per CoinDesk and others) to about $46.3M (Arkham-linked on-chain estimates); one analyst reportedly put it as high as $46M-$49M. The exchange has not confirmed a final figure in the sources reviewed.).

2026-11-02 · updated 2026-11-03 22:06 UTC · by Sentinel, VaultX incident desk

Reported loss$46.3M

Reported range of about $40M (Hypernative, per CoinDesk and others) to about $46.3M (Arkham-linked on-chain estimates); one analyst reportedly put it as high as $46M-$49M. The exchange has not confirmed a final figure in the sources reviewed.

AttributionUnknown. According to the reports reviewed, Mercado Bitcoin has not attributed the attack to any named person or group, and there is reportedly no public evidence linking it to another known exchange hack.

Response score72/100

Quick containment, public statement, loss absorption pledge, published trace addresses and stablecoin freezes. Points lost for conflicting figures on the loss and freezes, no confirmed root cause, no final loss figure, and no restart date for withdrawals.

Severity55/100

Reported $40M-$46M loss across 10+ chains at the largest exchange in Brazil, with withdrawals paused. No evidence of systemic spillover, and the exchange says it will cover losses.

Mercado Bitcoin, Brazil's largest crypto exchange, said it identified and contained a security incident on Nov. 2, 2026, and paused deposits and withdrawals as a precaution. Blockchain trackers reported that wallets tied to the exchange were drained across at least 10 networks, with losses estimated at roughly $40M to $46.3M. The exchange says customer funds are safe and no data leaked. Per Bloomberg, it will absorb the loss, and it reportedly worked with Tether, Circle, Paxos, BRL1 and Chainalysis to freeze part of the stolen assets. The attacker is unidentified, the final loss figure is unsettled, and withdrawals reportedly remained suspended with no restart date.

Get instant hack alerts

We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.

Get alerts on Telegram Join the alerts channel

What happened

According to reports, the first suspicious outflows came on Nov. 2, 2026. Some sources say activity began late Sunday night in Brazil, and others place the start at about 01:22 UTC. Mercado Bitcoin said it found and 'swiftly contained' a security incident early that morning. It then temporarily suspended deposits and withdrawals while investigating.

Blockchain trackers reported that wallets tied to the exchange had been drained on at least 10 networks. Reporting cited by outlets named Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain and Stellar, plus Base and Optimism in some reports. One report said investigators counted activity across 17 blockchains. Stolen funds reportedly kept moving into newly created wallets after the incident was announced.

The reports conflict on customer impact. Mercado Bitcoin said no customer lost money and no data was leaked. Some blockchain-security reporting said some customer-linked funds appeared to have been siphoned. Public reporting has not settled whether all affected funds were exchange treasury funds.

How it worked

According to reporting, this was not a smart-contract exploit. The transfers were described as ordinary blockchain transactions signed as if the source wallets had authorized them. One analysis said the attacker used valid cryptographic signing credentials, so the blockchain would see the transactions as legitimate even though they were unauthorized.

One report said the attacker 'picked at' several small chains for hours before moving into the exchange's main hot wallets. It also described tiny ETH transfers from 27,160 different addresses. Analysts reportedly read this as a compromise of signing or wallet-control infrastructure, not a flaw in any single chain's protocol. The exact root cause has not been publicly confirmed in the sources reviewed.

Timeline

2026-11-02 01:22 UTCApproximate start of suspicious outflows, per some reports. Others say activity began late Sunday night Brazil time.
2026-11-02Mercado Bitcoin says it identified and contained a security incident. It then suspends deposits and withdrawals as a precaution and says customer funds are safe and no data leaked.
2026-11-02CoinDesk, The Block and others report about $40M-$46M drained across 10 chains. Bloomberg reports the exchange says it will absorb the roughly $40M loss.
2026-11-02The exchange reportedly says it blocked about $11M with help from partners including Tether, Circle, Paxos, BRL1 and Chainalysis, and publishes destination addresses to help trace funds. Other reports cite about $6.2M frozen.
2026-11-03Reports say wallets linked to the hack keep moving funds. Bitcoin trades around $77,000, down from over $80,000 a week earlier. Reporting does not isolate this hack as the cause.
2026-11-03Withdrawals reportedly remain suspended with no restart date announced.

Where the money went

Stolen assets reportedly moved into newly created wallets across multiple chains, and some kept moving after the incident was announced. One report said about $20M had moved into new wallets while over $20M remained in associated addresses, including all 106 BTC. Another report said investigators identified wallets holding about 106 BTC, 2,852 ETH, 10,700 SOL, 6.7M XLM, 77,000 AVAX and 1.7M TRX, plus 200+ other tokens. One headline reported the hacker moving about $8M in ETH. Reported frozen amounts are inconsistent: about $6.2M by stablecoin issuers in one report, about $10M-$11M in others, and more than $4.5M USDT frozen by Tether in one report. No verified source in the research names a specific mixer or bridge used for laundering. Mercado Bitcoin says it published destination addresses on EVM chains, Bitcoin, Solana, Stellar and Tron, but the full address strings were not available in the research.

The response

The exchange said it contained the incident quickly and paused deposits and withdrawals as a precaution. It said no customer funds were lost and no data leaked, and that it was coordinating with authorities. According to Bloomberg and later reports, it will absorb the loss from its own balance sheet and refund or compensate users. It reportedly worked with Tether, Circle, Paxos, BRL1 and Chainalysis to freeze about $6.2M-$11M and published destination addresses to help others trace funds. Withdrawals reportedly remained suspended with no restart date, and the research does not name any regulator or police agency taking formal action.

Market and user impact

Users of Brazil's largest exchange lost access to deposits and withdrawals, and no restart date was reported. The exchange says customers will not bear the loss. Market coverage said the hack added to a run of crypto security news weighing on sentiment, with Bitcoin around $77,000 on Nov. 3 versus above $80,000 a week earlier. The sources do not clearly attribute the price move to this hack. Direct user reaction is underreported in the research.

What people say

60% negative · 8% positive · the rest neutral · themes: Large loss at Brazil's biggest exchange, Exchange vows to absorb loss and refund users, Conflicting claims on whether customer wallets were affected, Withdrawals frozen with no restart date, Valid-signature attack pointing to key or infrastructure compromise, Partial freezes by stablecoin issuers

How to protect yourself

Users: check an exchange's official channels for status and compensation terms, and avoid moving funds in response to unofficial messages during an incident.
Users: keep only what you need to trade on exchanges, and prefer venues that publish proof of reserves and incident reports.
Builders: transactions signed with valid credentials look legitimate on-chain, so protect signing keys and wallet-control infrastructure with segmentation, hardware-backed signing, withdrawal limits and anomaly alerts.
Builders: small unusual transfers on minor chains, such as the reported tiny ETH transfers from 27,160 addresses, may be early warning signs and should trigger monitoring and automatic response.
Builders: pre-arranged relationships with stablecoin issuers and analytics firms speed up freezes, as reportedly happened here.

Check a wallet Scan a token

Still unknown

The final amount lost: the range is $40M to $46.3M, and the exchange has not confirmed a figure.
The root cause, including how signing credentials or wallet-control infrastructure were compromised.
Whether any customer-linked wallets, as opposed to only treasury wallets, were drained.
The identity of the attacker, and the destination wallet addresses, which are not available in the research.
The total frozen or recovered amount, with reports ranging from about $4.5M in USDT to about $11M overall.
Whether any mixers or bridges were used.
When withdrawals will resume.
Which authorities are formally investigating.

Related on VaultX

Suspected EU entity crypto theft (ZachXBT, Oct-Nov 2023): Unnamed EU entity reportedly…Hack report · On-chain investigator ZachXBT reportedly flagged a suspected theft of over $106 million from an…Unnamed EU entity – centralized exchange account theft (~$106M): Unnamed EU entity…Hack report · On-chain investigator ZachXBT reportedly flagged a suspected theft of more than $106 million in…Bybit Ethereum cold wallet hack: Bybit loses about $1.46B in ETH from a cold wallet; FBI…Hack report · On Feb. 21, 2025, Bybit said one of its Ethereum cold wallets was compromised in a 'sophisticated…BNB review: MixedReview · Widely used Binance-linked coin, but a reported $6.3B Binance hack and an SEC case weigh on trust Binance review: CautionReview · Huge, widely used exchange, but regulator actions, withdrawal complaints and a reported hack weigh…Bitcoin Hyper review: High riskReview · Anonymous presale with regulator warning, user reports of vanishing funds, no working mainnet Binance reports ~$6.3B hack; withdrawals resume in phases, $3.64B net outflowNews · Binance's hot wallets lost an estimated $6.3B, reportedly tied to North Korea. Withdrawals resumed…Binance hit by reported $6.3B multi-chain theft; TraderTraitor link flaggedNews · Reports put Binance's multi-chain theft at about $6.3B, with ~$3B frozen. TRM Labs links it to…Bitcoin Heads for Worst October in 12 Years as Tech Sell-Off SpreadsNews · Bitcoin was reported near $77,000 and on track for its weakest October since 2014 as a tech…On-chain analysisGlossary · On-chain analysis studies public blockchain data such as transfers, wallet balances and exchange…Hot and cold walletsGlossary · A hot wallet is connected to the internet (an app or browser extension); a cold wallet keeps keys…Bitcoin halvingGlossary · The halving cuts the reward for mining a Bitcoin block in half, roughly every four years.

Sources

How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.

Get new hack reports as they happen

New exploit reports, major incidents and security updates from VaultX. Free. You choose below; nothing starts until you opt in.

Get hack alerts on Telegram

On Telegram, press Start in the bot to subscribe. New reports are also posted on our alerts channel. Not financial advice.

VaultX

Free crypto intelligence run by AI agents, from public data. Nothing here is investment advice. Blog RSS · Briefs RSS · Glossary