Mercado Bitcoin halts withdrawals after $40 million outflow

Mercado Bitcoin, Brazil's largest crypto exchange, paused all deposits and withdrawals on Monday after attackers drained its wallets. Blockchain security firm Hypernative put the loss at more than $40 million across at least 10 networks, a figure the exchange has not confirmed.

The company confirmed the incident in a statement on its official X account at 12:56 UTC on 2 November. It said it had identified and quickly contained a security breach in one of its systems overnight, that customers suffered no losses, and that no data had leaked. Deposits and withdrawals were paused as a precaution while its teams investigate.

What the exchange has said

Mercado Bitcoin kept its public account short. The statement, written in Portuguese, did not name the compromised system, give a loss figure, or say whose funds moved. It did not call the incident a hack. That silence matters. Without a named cause or a confirmed amount, outsiders are left to judge the scale from on-chain data alone.

About 90 minutes later the firm posted a list of destination addresses on EVM networks, Bitcoin, Solana, Stellar and Tron. It said it shared them so the funds could be identified and tracked. No reopening date was given. Mercado Bitcoin said it was working to restore operations safely.

How the money moved

Hypernative traced the outflows on-chain. Sweeps of the exchange's Bitcoin deposit addresses began at 02:15 UTC, the firm said. Most of the money then left in a narrow window. Between 06:19 and 06:53 UTC, wallets tied to the exchange pushed funds to fresh addresses across at least 10 chains.

These were plain transfers, not a smart contract exploit, according to Hypernative. The distinction is important. A plain transfer means someone held the keys, or could sign for the wallets, rather than exploiting a flaw in code. How the attacker got that access is not known. Spreading the money across many new addresses and several chains is a common way to slow tracing and frustrate any clawback.

The firm counted roughly 2,852 ETH, 106 BTC, 10,700 SOL and 6.7 million XLM among the moved assets, plus more than 200 other tokens. The wallets span Ethereum, Bitcoin, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain and Stellar. Opsek founder Pablo Sabbatella shared the alert publicly. Mercado Bitcoin has confirmed none of these numbers.

Unchained ran its own check of the Bitcoin address the exchange named. Using the Blockstream explorer at 14:58 UTC, it found about 106.07 BTC across seven transactions. The first landed in a block timestamped 05:42 UTC. A single transfer of 104.43 BTC arrived at 06:41 UTC. None of it had moved out of the address when the review was done.

A firm that helped build Brazil's alert system

There is an awkward backdrop. In August, Brazil's central bank said it had built a real-time crypto threat alert system with Hypernative, the same firm that flagged Monday's outflows. Mercado Bitcoin was named as one of the exchanges helping to put it in place. Regina Pedroso, executive director of the Brazilian Tokenization Association, said then that "the challenge now is to implement the tool" and that the central bank had already issued some bulletins. That work followed a 2025 breach at banking software provider C&M Software, in which thieves took an estimated $140 million to $180 million and moved part of it into crypto.

The second exchange hit in days

Timing stands out. This incident landed four days after attackers drained billions of dollars from Binance's hot wallets, in what researchers have called the largest crypto theft on record. The FBI tied that breach to North Korea's TraderTraitor group. Neither Mercado Bitcoin nor Hypernative has linked the two, and no public evidence connects them.

Some funds have already been frozen. Paolo Ardoino, who runs stablecoin issuer Tether, said about $4.5 million of USDT tied to the theft had been blocked, according to CoinDesk. Frozen stablecoins can sometimes be returned to victims. Assets that have been swapped or bridged are far harder to recover.

A pattern is forming. The blockchains themselves are not the weak point in these recent thefts. Keys, internal systems and the people who control them are. Mercado Bitcoin's drain, moved through plain transfers rather than a code exploit, fits that run of exchange and infrastructure failures rather than broken cryptography.

What to watch

Three questions decide how bad this gets. Will the exchange confirm or dispute the $40 million estimate and name the system that failed. Will it say when deposits and withdrawals reopen. And will client balances hold once services return, which is the real test of the no-losses claim.

Brazilian users feel the practical effect now. Money parked on the exchange cannot be moved while the freeze holds. The company's assurance that balances are safe cannot be checked from outside until withdrawals reopen and people can pull funds.

For now, users cannot move their money on Brazil's biggest exchange. The company says that is temporary. It has not said for how long.