Hacks & scams / Exchange breach
52severity
Exchange breachcontainedBitcoinEthereumSolanaTron
Mercado Bitcoin security incident: Mercado Bitcoin halts deposits and withdrawals after reported $40M+ in suspicious transfers across 10+ chains
2026-11-02 · updated 2026-11-02 15:57 UTC · by Sentinel, VaultX incident desk
Reported loss$40.0MReported as 'more than $40 million' in suspicious transfers, a preliminary external estimate (attributed to Hypernative). Mercado Bitcoin has not confirmed it as a loss figure. It is unclear whether it is realized theft, gross outflow, or includes traceable funds.
Attributionunknown. The reports reviewed name no perpetrator.
Response score62/100Reasonably fast public confirmation, a withdrawal pause and reportedly shared addresses, but the cause, final loss and recovery or compensation details are not disclosed.
Severity52/100A reported $40M+ outflow across 10+ chains at a major regional exchange, with withdrawals paused. Customer losses are denied and there are no signs of systemic spillover.
On 2 November 2026, blockchain security firm Hypernative reportedly flagged suspicious transfers from wallets attributed to Brazilian exchange Mercado Bitcoin. The exchange then confirmed a security incident in one of its systems and paused deposits and withdrawals. Early external estimates put the outflow at more than $40 million across at least 10 blockchains. The exchange says customer assets were not affected, no customer data leaked, and the incident is contained. The attack method, the final loss and the perpetrator are not yet public.
Get instant hack alerts
We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.
What happened
According to the reports, Hypernative flagged suspicious outflows from wallets attributed to Mercado Bitcoin. The exchange then confirmed a security incident affecting one of its systems and temporarily suspended deposits and withdrawals.
Reported timing: some coverage says the first suspicious activity, on Bitcoin deposit addresses, appeared around 02:15 UTC on 2 November 2026. A larger batch of transfers reportedly moved between about 06:19 and 06:53 UTC.
The outflow was reportedly spread across at least 10 networks. Wallets linked to the incident reportedly held about 2,852 ETH, 106 BTC, 10.7K SOL, 6.7M XLM, 77K AVAX, 1.7M TRX and more than 200 other tokens. One report gives 106.07 BTC and 2,852.07 ETH.
Mercado Bitcoin said customer assets were not affected and that no customer data was leaked. It described the incident as contained while investigation and asset tracing continued. One report says the $40M estimate may change once all source addresses are confirmed as exchange wallets.
How it worked
The reporting describes a cyberattack or security breach on an exchange system, not a smart-contract or DeFi exploit. The pattern reportedly looks like ordinary signed transfers out of compromised exchange wallets.
That points to compromised signing infrastructure, exposed private keys, or another form of wallet access compromise. The reports reviewed do not confirm the actual method, and one source explicitly says it remains unclear.
Timeline
- 2026-11-02 02:15 UTCFirst suspicious activity on Bitcoin deposit addresses reportedly observed (per one report).
- 2026-11-02 06:19 UTCA larger batch of suspicious transfers reportedly begins; it runs to about 06:53 UTC.
- 2026-11-02Hypernative reportedly flags suspicious transfers from wallets attributed to Mercado Bitcoin and estimates more than $40M across 10+ chains.
- 2026-11-02Mercado Bitcoin confirms a security incident, suspends deposits and withdrawals, and says customer assets and data were not affected.
- 2026-11-02The exchange describes the incident as contained. One report says it later shared identified destination addresses so they could be tracked; the addresses are not in the available material.
Where the money went
Funds reportedly left exchange-attributed wallets across at least 10 chains. One report says Mercado Bitcoin identified destination addresses and shared them for tracking, but the addresses are not in the available research and are not reproduced here. The reports reviewed give no confirmed laundering route, bridge or mixer use, or frozen or recovered amount.
The response
Mercado Bitcoin confirmed a security incident, paused deposits and withdrawals as a precaution, and said the incident was contained. It stated that customer assets were unaffected and no customer data leaked, and reportedly shared destination addresses for tracking. The reports reviewed do not show any regulator or police action, compensation plan, insurance-fund use, or recovery.
Market and user impact
Deposits and withdrawals were suspended at what one outlet calls Brazil's largest crypto exchange, so users cannot move funds while the investigation continues. The exchange says customers will not bear losses. Market-price impact and user reactions are not documented in the material reviewed.
What people say
50% negative · 10% positive · the rest neutral · themes: frozen withdrawals, unclear cause, exchange reassurance that customers are unaffected, uncertainty over the loss figure
How to protect yourself
- For users: wait for official updates, treat any DMs or emails about 'recovering funds' as likely phishing, and do not move funds to unfamiliar addresses.
- For users: do not keep more on an exchange than you need to trade, and keep long-term holdings in self-custody.
- For exchanges: segregate and limit hot-wallet balances, harden key management and signing infrastructure, and use real-time on-chain monitoring, which is how this incident was reportedly flagged.
- For exchanges: publish a clear post-mortem and proof of reserves quickly after an incident.
Check a walletScan a tokenStill unknown
- The case title refers to October 2023, but the research describes an incident on 2 November 2026; this report covers the 2026 event and none of the research verifies an October 2023 incident.
- Whether the $40M is realized theft, gross outflow, or includes traceable funds, and what the final loss is.
- The attack method: compromised keys, signing infrastructure or something else.
- The attacker's identity and attribution.
- Attacker or destination wallet addresses, as none appear in the research.
- Whether any funds were frozen or recovered.
- When withdrawals will resume, and whether regulators or police are involved.
Related on VaultX
Binance multi-chain hack (TraderTraitor-linked): Binance loses a reported ~$6.3B across…Hack report · Binance disclosed a security incident on Oct. 29, 2026. Reports put the loss at about $6.3B, taken…Mixin Network: Mixin Network says ~$200M lost after cloud-database breach; deposits and…Hack report · According to Mixin Network, attackers compromised the database of its cloud service provider in…Bybit Ethereum cold wallet hack: Bybit loses about $1.46B in ETH from a cold wallet; FBI…Hack report · On Feb. 21, 2025, Bybit said one of its Ethereum cold wallets was compromised in a 'sophisticated…BNB review: MixedReview · Widely used Binance-linked coin, but a reported $6.3B Binance hack and an SEC case weigh on trustBitcoin review: MixedReview · 18-year-old open-source network with no issuer; US regulators call it highly speculativeBitcoin Hyper review: High riskReview · Anonymous presale with regulator warning, user reports of vanishing funds, no working mainnetBinance hit by reported $6.3B multi-chain theft; TraderTraitor link flaggedNews · Reports put Binance's multi-chain theft at about $6.3B, with ~$3B frozen. TRM Labs links it to…Binance reopens withdrawals in phases after hack-driven haltNews · Binance starts reopening withdrawals in phases after a multi-day halt linked to a reported $6.3B…Binance reports ~$6.3B hack; withdrawals resume in phases, $3.64B net outflowNews · Binance's hot wallets lost an estimated $6.3B, reportedly tied to North Korea. Withdrawals resumed…Exchange inflow and outflowGlossary · Inflow is crypto sent to exchanges; outflow is crypto withdrawn from them to private wallets.Bitcoin (BTC)Glossary · Bitcoin is the first cryptocurrency, launched in 2009. It runs on a public ledger kept by…Hot and cold walletsGlossary · A hot wallet is connected to the internet (an app or browser extension); a cold wallet keeps keys…
Sources
- ChainCatcher: Mercado Bitcoin incident
- Cryptonomist: Mercado Bitcoin cyberattack
- Crypto Briefing: Mercado Bitcoin suspends deposits, withdrawals ($40M)
- Koinbulteni: Brazil's largest crypto exchange hit by cyberattack
- Pluang: Mercado Bitcoin halts deposits and withdrawals
- BBX news detail
- Coinfomania: Mercado Bitcoin confirms cyberattack with estimated losses
- Hokanews: Mercado Bitcoin confirms cyberattack
- Yahoo Finance: Mercado Bitcoin halts withdrawals
- Phemex: Mercado Bitcoin halts deposits and withdrawals after security breach
- Crypto.news: Mercado Bitcoin reports security incident
How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.
Get new hack reports as they happen
New exploit reports, major incidents and security updates from VaultX. Free. You choose below; nothing starts until you opt in.
On Telegram, press Start in the bot to subscribe. New reports are also posted on our alerts channel. Not financial advice. 
VaultX