# Mercado Bitcoin exchange hack: Brazil's largest exchange Mercado Bitcoin reportedly loses $40M-$46M across 10+ chains, vows to absorb loss
Source page: https://vaultx.llc/hacks/brazil-exchange-hack · VaultX incident report by Sentinel · first published 2026-11-04, updated 2026-11-03
- Date: 2026-11-02
- Reported loss: $46.3M (Reported range of about $40M (Hypernative, per CoinDesk and others) to about $46.3M (Arkham-linked on-chain estimates); one analyst reportedly put it as high as $46M-$49M. The exchange has not confirmed a final figure in the sources reviewed.)
- Attribution: Unknown. According to the reports reviewed, Mercado Bitcoin has not attributed the attack to any named person or group, and there is reportedly no public evidence linking it to another known exchange hack.
- Chains: Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain, Stellar, Base (some reports), Optimism (some reports)
- Status: contained
- Severity: 55/100
- Response score: 72/100 (Quick containment, public statement, loss absorption pledge, published trace addresses and stablecoin freezes. Points lost for conflicting figures on the loss and freezes, no confirmed root cause, no final loss figure, and no restart date for withdrawals.)
Mercado Bitcoin, Brazil's largest crypto exchange, said it identified and contained a security incident on Nov. 2, 2026, and paused deposits and withdrawals as a precaution. Blockchain trackers reported that wallets tied to the exchange were drained across at least 10 networks, with losses estimated at roughly $40M to $46.3M. The exchange says customer funds are safe and no data leaked. Per Bloomberg, it will absorb the loss, and it reportedly worked with Tether, Circle, Paxos, BRL1 and Chainalysis to freeze part of the stolen assets. The attacker is unidentified, the final loss figure is unsettled, and withdrawals reportedly remained suspended with no restart date.

**What happened**
According to reports, the first suspicious outflows came on Nov. 2, 2026. Some sources say activity began late Sunday night in Brazil, and others place the start at about 01:22 UTC. Mercado Bitcoin said it found and 'swiftly contained' a security incident early that morning. It then temporarily suspended deposits and withdrawals while investigating.
Blockchain trackers reported that wallets tied to the exchange had been drained on at least 10 networks. Reporting cited by outlets named Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain and Stellar, plus Base and Optimism in some reports. One report said investigators counted activity across 17 blockchains. Stolen funds reportedly kept moving into newly created wallets after the incident was announced.
The reports conflict on customer impact. Mercado Bitcoin said no customer lost money and no data was leaked. Some blockchain-security reporting said some customer-linked funds appeared to have been siphoned. Public reporting has not settled whether all affected funds were exchange treasury funds.

**How it worked**
According to reporting, this was not a smart-contract exploit. The transfers were described as ordinary blockchain transactions signed as if the source wallets had authorized them. One analysis said the attacker used valid cryptographic signing credentials, so the blockchain would see the transactions as legitimate even though they were unauthorized.
One report said the attacker 'picked at' several small chains for hours before moving into the exchange's main hot wallets. It also described tiny ETH transfers from 27,160 different addresses. Analysts reportedly read this as a compromise of signing or wallet-control infrastructure, not a flaw in any single chain's protocol. The exact root cause has not been publicly confirmed in the sources reviewed.

**Where the money went**
Stolen assets reportedly moved into newly created wallets across multiple chains, and some kept moving after the incident was announced. One report said about $20M had moved into new wallets while over $20M remained in associated addresses, including all 106 BTC. Another report said investigators identified wallets holding about 106 BTC, 2,852 ETH, 10,700 SOL, 6.7M XLM, 77,000 AVAX and 1.7M TRX, plus 200+ other tokens. One headline reported the hacker moving about $8M in ETH. Reported frozen amounts are inconsistent: about $6.2M by stablecoin issuers in one report, about $10M-$11M in others, and more than $4.5M USDT frozen by Tether in one report. No verified source in the research names a specific mixer or bridge used for laundering. Mercado Bitcoin says it published destination addresses on EVM chains, Bitcoin, Solana, Stellar and Tron, but the full address strings were not available in the research.

**The response**
The exchange said it contained the incident quickly and paused deposits and withdrawals as a precaution. It said no customer funds were lost and no data leaked, and that it was coordinating with authorities. According to Bloomberg and later reports, it will absorb the loss from its own balance sheet and refund or compensate users. It reportedly worked with Tether, Circle, Paxos, BRL1 and Chainalysis to freeze about $6.2M-$11M and published destination addresses to help others trace funds. Withdrawals reportedly remained suspended with no restart date, and the research does not name any regulator or police agency taking formal action.

**Impact**
Users of Brazil's largest exchange lost access to deposits and withdrawals, and no restart date was reported. The exchange says customers will not bear the loss. Market coverage said the hack added to a run of crypto security news weighing on sentiment, with Bitcoin around $77,000 on Nov. 3 versus above $80,000 a week earlier. The sources do not clearly attribute the price move to this hack. Direct user reaction is underreported in the research.

**Timeline**
- 2026-11-02 01:22 UTC Approximate start of suspicious outflows, per some reports. Others say activity began late Sunday night Brazil time.
- 2026-11-02 Mercado Bitcoin says it identified and contained a security incident. It then suspends deposits and withdrawals as a precaution and says customer funds are safe and no data leaked.
- 2026-11-02 CoinDesk, The Block and others report about $40M-$46M drained across 10 chains. Bloomberg reports the exchange says it will absorb the roughly $40M loss.
- 2026-11-02 The exchange reportedly says it blocked about $11M with help from partners including Tether, Circle, Paxos, BRL1 and Chainalysis, and publishes destination addresses to help trace funds. Other reports cite about $6.2M frozen.
- 2026-11-03 Reports say wallets linked to the hack keep moving funds. Bitcoin trades around $77,000, down from over $80,000 a week earlier. Reporting does not isolate this hack as the cause.
- 2026-11-03 Withdrawals reportedly remain suspended with no restart date announced.

**How to protect yourself**
- Users: check an exchange's official channels for status and compensation terms, and avoid moving funds in response to unofficial messages during an incident.
- Users: keep only what you need to trade on exchanges, and prefer venues that publish proof of reserves and incident reports.
- Builders: transactions signed with valid credentials look legitimate on-chain, so protect signing keys and wallet-control infrastructure with segmentation, hardware-backed signing, withdrawal limits and anomaly alerts.
- Builders: small unusual transfers on minor chains, such as the reported tiny ETH transfers from 27,160 addresses, may be early warning signs and should trigger monitoring and automatic response.
- Builders: pre-arranged relationships with stablecoin issuers and analytics firms speed up freezes, as reportedly happened here.

**Still unknown**
- The final amount lost: the range is $40M to $46.3M, and the exchange has not confirmed a figure.
- The root cause, including how signing credentials or wallet-control infrastructure were compromised.
- Whether any customer-linked wallets, as opposed to only treasury wallets, were drained.
- The identity of the attacker, and the destination wallet addresses, which are not available in the research.
- The total frozen or recovered amount, with reports ranging from about $4.5M in USDT to about $11M overall.
- Whether any mixers or bridges were used.
- When withdrawals will resume.
- Which authorities are formally investigating.

**Sources**
- Brazil's Biggest Bitcoin Exchange Says It Will Refund Users After a $40 Million Hack (Yahoo Finance) https://finance.yahoo.com/markets/crypto/articles/brazils-biggest-bitcoin-exchange-says-181603340.html
- Mercado Bitcoin hack drains $46M across ten chains, valid signatures (TechTimes) https://www.techtimes.com/articles/329928/20261103/mercado-bitcoin-hack-drains-46-million-across-ten-chains-valid-signatures.htm
- Brazil's largest crypto exchange hit by $46M theft (CryptoProwl via TradingView) https://www.tradingview.com/news/cryptoprowl:645e8f647094b:0-brazil-s-largest-crypto-exchange-hit-by-46-million-theft/
- Mercado Bitcoin wallets keep moving funds after $46M hack (Cointelegraph via TradingView) https://www.tradingview.com/news/cointelegraph:67fe83c5c094b:0-mercado-bitcoin-wallets-keep-moving-funds-after-46m-hack/
- Brazil's largest crypto exchange Mercado Bitcoin (Yahoo Finance) https://finance.yahoo.com/markets/crypto/articles/brazil-largest-crypto-exchange-mercado-151710285.html
- Brazil's Mercado Bitcoin halts withdrawals after $40 million drained across 10 chains (CoinDesk) https://www.coindesk.com/business/2026/11/02/brazil-s-mercado-bitcoin-halts-withdrawals-after-usd40-million-drained-across-10-chains
- Mercado Bitcoin suffers hack but says customer funds are safe (Portal do Bitcoin) https://portaldobitcoin.uol.com.br/mercado-bitcoin-suffers-hack-but-says-customer-funds-are-safe/
- Mercado Bitcoin Brazil cryptocurrency heist (The Record) https://therecord.media/mercado-bitcoin-brazil-cryptocurrency-heist
- Mercado Bitcoin hack, $46 million, Brazil exchange (The Block) https://www.theblock.co/news/defi/2026-11-02-mercado-bitcoin-hack-46-million-brazil -exchange-432333
- Mercado Bitcoin hack: trace the $46M stolen on-chain (Arkham) https://info.arkm.com/research/mercado-bitcoin-hack-trace-the-46m-stolen-on-chain
- Mercado Bitcoin says it will absorb $40 million loss from hack (Bloomberg) https://www.bloomberg.com/news/articles/2026-11-02/mercado-bitcoin-says-it-will-absorb-40-million-loss-from-hack
- ChainCatcher: Mercado Bitcoin incident https://www.chaincatcher.com/en/article/2301077
- Cryptonomist: Mercado Bitcoin cyberattack https://www.cryptonomist.ch/2026/11/02/mercado-bitcoin-cyberattack/
- Crypto Briefing: Mercado Bitcoin suspends deposits, withdrawals ($40M) https://cryptobriefing.com/mercado-bitcoin-suspends-deposits-withdrawals-40m/
- Koinbulteni: Brazil's largest crypto exchange hit by cyberattack https://koinbulteni.com/en/brazils-largest-crypto-exchange-hit-by-cyberattack-withdrawals-suspended-291621.html
- Pluang: Mercado Bitcoin halts deposits and withdrawals https://pluang.com/en/news-feed/mercado-bitcoin-hentikan-setoran-penarikan-setelah-insiden-keamanan
- BBX news detail https://bbx.com/news-detail/3164400
- Coinfomania: Mercado Bitcoin confirms cyberattack with estimated losses https://coinfomania.com/mercado-bitcoin-confirms-cyberattack-with-estimated-losses/
- Hokanews: Mercado Bitcoin confirms cyberattack https://www.hokanews.com/2026/11/mercado-bitcoin-confirms-cyberattack-as.html
- Yahoo Finance: Mercado Bitcoin halts withdrawals https://finance.yahoo.com/markets/crypto/articles/mercado-bitcoin-halts-withdrawals-over-153238091.html

---
VaultX: free crypto news and intelligence, https://vaultx.llc