# Mercado Bitcoin security incident: Mercado Bitcoin halts deposits and withdrawals after reported $40M+ in suspicious transfers across 10+ chains
Source page: https://vaultx.llc/hacks/mercado-bitcoin-withdrawals-halted-october-2023 · VaultX incident report by Sentinel · first published 2026-11-02, updated 2026-11-02
- Date: 2026-11-02
- Reported loss: $40.0M (Reported as 'more than $40 million' in suspicious transfers, a preliminary external estimate (attributed to Hypernative). Mercado Bitcoin has not confirmed it as a loss figure. It is unclear whether it is realized theft, gross outflow, or includes traceable funds.)
- Attribution: unknown. The reports reviewed name no perpetrator.
- Chains: Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain, Stellar, at least one further network not named in shorter summaries
- Status: contained
- Severity: 52/100
- Response score: 62/100 (Reasonably fast public confirmation, a withdrawal pause and reportedly shared addresses, but the cause, final loss and recovery or compensation details are not disclosed.)
On 2 November 2026, blockchain security firm Hypernative reportedly flagged suspicious transfers from wallets attributed to Brazilian exchange Mercado Bitcoin. The exchange then confirmed a security incident in one of its systems and paused deposits and withdrawals. Early external estimates put the outflow at more than $40 million across at least 10 blockchains. The exchange says customer assets were not affected, no customer data leaked, and the incident is contained. The attack method, the final loss and the perpetrator are not yet public.

**What happened**
According to the reports, Hypernative flagged suspicious outflows from wallets attributed to Mercado Bitcoin. The exchange then confirmed a security incident affecting one of its systems and temporarily suspended deposits and withdrawals.
Reported timing: some coverage says the first suspicious activity, on Bitcoin deposit addresses, appeared around 02:15 UTC on 2 November 2026. A larger batch of transfers reportedly moved between about 06:19 and 06:53 UTC.
The outflow was reportedly spread across at least 10 networks. Wallets linked to the incident reportedly held about 2,852 ETH, 106 BTC, 10.7K SOL, 6.7M XLM, 77K AVAX, 1.7M TRX and more than 200 other tokens. One report gives 106.07 BTC and 2,852.07 ETH.
Mercado Bitcoin said customer assets were not affected and that no customer data was leaked. It described the incident as contained while investigation and asset tracing continued. One report says the $40M estimate may change once all source addresses are confirmed as exchange wallets.

**How it worked**
The reporting describes a cyberattack or security breach on an exchange system, not a smart-contract or DeFi exploit. The pattern reportedly looks like ordinary signed transfers out of compromised exchange wallets.
That points to compromised signing infrastructure, exposed private keys, or another form of wallet access compromise. The reports reviewed do not confirm the actual method, and one source explicitly says it remains unclear.

**Where the money went**
Funds reportedly left exchange-attributed wallets across at least 10 chains. One report says Mercado Bitcoin identified destination addresses and shared them for tracking, but the addresses are not in the available research and are not reproduced here. The reports reviewed give no confirmed laundering route, bridge or mixer use, or frozen or recovered amount.

**The response**
Mercado Bitcoin confirmed a security incident, paused deposits and withdrawals as a precaution, and said the incident was contained. It stated that customer assets were unaffected and no customer data leaked, and reportedly shared destination addresses for tracking. The reports reviewed do not show any regulator or police action, compensation plan, insurance-fund use, or recovery.

**Impact**
Deposits and withdrawals were suspended at what one outlet calls Brazil's largest crypto exchange, so users cannot move funds while the investigation continues. The exchange says customers will not bear losses. Market-price impact and user reactions are not documented in the material reviewed.

**Timeline**
- 2026-11-02 02:15 UTC First suspicious activity on Bitcoin deposit addresses reportedly observed (per one report).
- 2026-11-02 06:19 UTC A larger batch of suspicious transfers reportedly begins; it runs to about 06:53 UTC.
- 2026-11-02 Hypernative reportedly flags suspicious transfers from wallets attributed to Mercado Bitcoin and estimates more than $40M across 10+ chains.
- 2026-11-02 Mercado Bitcoin confirms a security incident, suspends deposits and withdrawals, and says customer assets and data were not affected.
- 2026-11-02 The exchange describes the incident as contained. One report says it later shared identified destination addresses so they could be tracked; the addresses are not in the available material.

**How to protect yourself**
- For users: wait for official updates, treat any DMs or emails about 'recovering funds' as likely phishing, and do not move funds to unfamiliar addresses.
- For users: do not keep more on an exchange than you need to trade, and keep long-term holdings in self-custody.
- For exchanges: segregate and limit hot-wallet balances, harden key management and signing infrastructure, and use real-time on-chain monitoring, which is how this incident was reportedly flagged.
- For exchanges: publish a clear post-mortem and proof of reserves quickly after an incident.

**Still unknown**
- The case title refers to October 2023, but the research describes an incident on 2 November 2026; this report covers the 2026 event and none of the research verifies an October 2023 incident.
- Whether the $40M is realized theft, gross outflow, or includes traceable funds, and what the final loss is.
- The attack method: compromised keys, signing infrastructure or something else.
- The attacker's identity and attribution.
- Attacker or destination wallet addresses, as none appear in the research.
- Whether any funds were frozen or recovered.
- When withdrawals will resume, and whether regulators or police are involved.

**Sources**
- ChainCatcher: Mercado Bitcoin incident https://www.chaincatcher.com/en/article/2301077
- Cryptonomist: Mercado Bitcoin cyberattack https://www.cryptonomist.ch/2026/11/02/mercado-bitcoin-cyberattack/
- Crypto Briefing: Mercado Bitcoin suspends deposits, withdrawals ($40M) https://cryptobriefing.com/mercado-bitcoin-suspends-deposits-withdrawals-40m/
- Koinbulteni: Brazil's largest crypto exchange hit by cyberattack https://koinbulteni.com/en/brazils-largest-crypto-exchange-hit-by-cyberattack-withdrawals-suspended-291621.html
- Pluang: Mercado Bitcoin halts deposits and withdrawals https://pluang.com/en/news-feed/mercado-bitcoin-hentikan-setoran-penarikan-setelah-insiden-keamanan
- BBX news detail https://bbx.com/news-detail/3164400
- Coinfomania: Mercado Bitcoin confirms cyberattack with estimated losses https://coinfomania.com/mercado-bitcoin-confirms-cyberattack-with-estimated-losses/
- Hokanews: Mercado Bitcoin confirms cyberattack https://www.hokanews.com/2026/11/mercado-bitcoin-confirms-cyberattack-as.html
- Yahoo Finance: Mercado Bitcoin halts withdrawals https://finance.yahoo.com/markets/crypto/articles/mercado-bitcoin-halts-withdrawals-over-153238091.html
- Phemex: Mercado Bitcoin halts deposits and withdrawals after security breach https://phemex.com/news/article/brazilian-exchange-mercado-bitcoin-halts-deposits-and-withdrawals-after-security-breach-102109
- Crypto.news: Mercado Bitcoin reports security incident https://crypto.news/brazils-mercado-bitcoin-reports-security-incident-freezes-withdrawals/

---
VaultX: free crypto news and intelligence, https://vaultx.llc