Brazilian cryptocurrency exchange Mercado Bitcoin suspended deposits and withdrawals on November 2 after confirming a security incident in one of its systems. Blockchain investigators identified more than $40 million in suspicious transfers from wallets attributed to the exchange across at least ten networks, with funds reportedly continuing to move after the initial outflows. The exchange has not confirmed the value of any theft.
Mercado Bitcoin said it quickly contained the incident and that customers had suffered no financial losses or personal-data exposure. It is investigating the transactions, tracing assets and coordinating with authorities. Its official November 2 statement did not identify the affected infrastructure, provide an independently reconciled loss figure or set a date for withdrawals to resume.
Hypernative initially estimated suspicious outflows above $40 million. A later figure exceeding $46 million has also circulated in investigator accounts, including reporting attributed to Arkham Intelligence, but that larger estimate has not been independently reconciled with the published exchange statement. Neither figure should be treated as an official loss or as a measure of customers’ missing account balances.
Why did exchange-linked wallets keep moving funds?
The earliest suspicious activity identified by Hypernative reportedly began around 02:15 UTC on November 2, after 11 p.m. the previous night in Brasília. A more concentrated burst between approximately 06:19 and 06:53 UTC involved addresses attributed to Mercado Bitcoin across Ethereum, Bitcoin, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain, Stellar and other networks.
The preliminary asset breakdown cited by Brazilian investigators included approximately 106 BTC, 2,852 ETH, 10,700 SOL, 6.7 million XLM, 77,000 AVAX and a broad collection of smaller tokens. These holdings and transfers are timestamp-dependent snapshots and should not be added to the total reported by Hypernative as separate losses. The researchers’ attribution of source and destination wallets remains important to verifying the overall amount.
CertiK senior security engineer Dickson Wu separately described a sequence beginning on smaller networks, including Base, Optimism and Arbitrum, before reaching operational hot wallets. His preliminary account also described small Ether transfers originating from 27,160 addresses, raising the possibility that access extended to customer deposit infrastructure. The full address-level count and the degree of attacker control over every source address have not been independently verified in the public material reviewed for this article.
This is a particularly serious possibility because a public blockchain does not stop accepting transfers when an exchange disables deposits in its application. A customer can still send coins to a previously issued deposit address. If an unauthorized party can sign transactions from that address, newly arriving assets may be diverted before the exchange can safely sweep them into protected custody.
The transactions identified in early monitoring were ordinary asset transfers rather than a demonstrated smart-contract exploit. That pattern suggests someone obtained signing capability, but it does not prove that private keys were copied. A compromised signing service, exposed credentials or another failure in withdrawal authorization could produce similar on-chain evidence. Mercado Bitcoin has not published a root-cause finding.
The risk is familiar from CoinDCX’s confirmed $15.99 million loss involving previously compromised deposit addresses. That incident arose from a separate operational failure, not a known connection to Mercado Bitcoin, but demonstrates why retiring an address in an application does not necessarily eliminate the danger of funds later reaching it.
How much of the suspected outflow has been frozen?
Blockchain analysts have tracked assets into newly created destinations, including wallets holding substantial amounts of bitcoin and ether. Initial monitoring also identified stablecoin balances that issuers could potentially restrict, which makes the precise timing of freezing actions critical.
Brazilian reports earlier on November 2 said Tether had blocked approximately $3.7 million in USDT linked to the incident. A later report citing Tether chief executive Paolo Ardoino said more than 4.5 million USDT had been frozen. The two figures describe observations at different points and must not be added together. A preliminary combined freeze estimate of roughly $6.2 million involving Tether and Circle has also been circulated, but its breakdown and final confirmation were not independently established during this review.
Token-level freezing can prevent specified USDT or USDC balances from moving once an issuer’s controls apply. It cannot reverse earlier transfers, identify the legal owner of the stolen assets or guarantee that the funds will reach the exchange. Native bitcoin has no equivalent issuer-operated freeze function.
The distinction between finding an attacker wallet, immobilizing a token and returning money to its rightful owner is explained in DaveFinances’ analysis of stolen USDT freezes and recovery. It is particularly important when public estimates mix funds still held in attacker-linked wallets, amounts already frozen and assets moved between those addresses. Repeated transfers of the same coins are not additional thefts.
The exchange has not publicly reconciled the estimated outflows against its own holdings, customer liabilities, insurance, recovered assets or the amount still under attacker control. Consequently, the market does not yet have the information needed to calculate a verified net loss.
Are Mercado Bitcoin customers protected despite the pause?
The company’s assertion that customers suffered no losses does not necessarily contradict the appearance of unauthorized outflows. An exchange can absorb an operational loss using its own assets while preserving the recorded balances owed to customers. However, keeping those balances intact is different from providing immediate access to the assets when deposits and withdrawals have been suspended.
Customers therefore face an operational restriction even if their account balances remain unchanged. The security investigation may need to establish that all affected transaction-signing paths and deposit-address sweeping processes are safe before transfers are resumed. No public timetable had been confirmed in the material reviewed.
Three checks would help establish whether Mercado Bitcoin has contained the incident: disclosure of the compromised system and affected networks; a reconciliation of stolen or inaccessible assets against customer liabilities; and a staged reopening in which legitimate deposits and withdrawals process without further unexplained transfers. A claim that access was contained needs to be tested against later activity from addresses that remain exposed.
The distinction between operational losses and customer shortfalls is particularly important for investors evaluating centralized exchanges. Customer assets can remain contractually owed even if an exchange suffers a theft, but that obligation does not alone disclose the provider’s immediately available liquidity or ability to fund replacement assets.
What does the breach mean after Binance’s $6.3 billion hack?
The Mercado Bitcoin incident occurred four days after Binance reported a $6.3 billion cryptocurrency theft on October 29. Binance began reopening withdrawals by asset and network on November 1 and said it had sourced replacement tokens covering approximately 95% of its affected holdings using company resources and protection funds.
As detailed in DaveFinances’ report on Binance’s phased withdrawal restart, reopening a blockchain network, restoring customer reserves and recovering stolen assets are separate measures. The timing provides a useful comparison for customers assessing restrictions at Mercado Bitcoin, but no verified evidence connects the two attacks or identifies a common perpetrator.
Mercado Bitcoin has not disclosed whether the same infrastructure weakness affected wallets on every network, whether previously issued deposit addresses remain sensitive, or when its own withdrawals can safely resume. Researchers will also need to distinguish transfers that occur after an announcement from new unauthorized withdrawals: a transaction appearing later on-chain may move funds already taken earlier, without demonstrating a separate post-containment breach.
For now, the confirmed facts are a security incident acknowledged by Mercado Bitcoin and a precautionary halt to deposits and withdrawals. The more than $40 million in suspicious on-chain transfers is an externally generated estimate, while higher valuations and preliminary asset-freeze figures still require reconciliation. The next material update is an official explanation of the scope, net exposure and safeguards protecting customers when services reopen.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574