Brazil's Mercado Bitcoin suspends withdrawals after security incident, says customers will not lose money

Mercado Bitcoin, Brazil's largest cryptocurrency exchange, detected a security incident early on 2 November 2026 and suspended deposits and withdrawals while it investigates. For Mercado Bitcoin customers who need to move funds, that suspension is the immediate fact, and the exchange says customers will not lose money and that it will absorb the loss.

What happened

In the early hours of 2 November, Mercado Bitcoin said it had identified and quickly contained a security incident in one of its systems, then suspended deposits and withdrawals as a preventive measure while insisting there had been no loss to clients and no data leak.

Blockchain security firm Hypernative flagged more than $40m in suspicious transfers from wallets it linked to the exchange, across at least 10 blockchains including Bitcoin, Ethereum, Solana and Tron. The firm described the outflows as plain transfers rather than a smart contract exploit, with the main window between 06:19 and 06:53 UTC, and said it was still unclear how the attacker gained signing access, a point Mercado Bitcoin has left open: it has confirmed neither Hypernative's figures nor how the incident happened.

The incident came four days after hackers drained about $6.3bn from Binance's hot wallets on 29 October, an attack the FBI attributed to North Korea's TraderTraitor group, though neither Mercado Bitcoin nor Hypernative has linked the two events.

What Mercado Bitcoin says about customer funds

Mercado Bitcoin says customer assets are guaranteed, with balances still recorded in customers' accounts. Its first update, on the evening of 2 November, put the assets involved at about $38m and said about $11m had been blocked working with Tether, Circle, Paxos, BRL1 and Chainalysis, while Tether separately froze more than $4.5m in USDT linked to the incident.

The exchange revised its figures on 3 November, putting the assets affected at about $36.3m with about $12.9m blocked so far and the blocking work continuing. Blocked funds are not the same as returned funds, and the exchange has not said how much, if any, has been recovered to customer accounts.

No date has been given for deposits and withdrawals to reopen. Services will resume only once full security conditions are in place, the exchange says, with a gradual reopening as each function passes its security checks and timing shared through its official channels. As of 3 November, its website, app and login were listed as operational, while deposits and withdrawals had no separate status listing.

The exchange also warned customers that it never asks for a password, verification code or recovery phrase, and does not offer refunds through links, WhatsApp or phone calls. Fake support messages and refund offers tend to circulate while users wait for an update after a widely reported incident.

What is still unknown

The final loss figure is not settled. The exchange's own figure moved within a day, from about $38m to about $36.3m, while independent estimates run higher, with Arkham tracing at least $46m and Chainalysis putting the figure at about $49m across 17 chains. None of those tracker totals has been confirmed by Mercado Bitcoin, so this piece reports them as estimates, not as a confirmed stolen total.

The cause is also not settled, and the exchange has not named an attacker or said whether any of the blocked funds have been returned. Until deposits and withdrawals reopen, customers can see their balances but cannot move them, and the only reopening condition the exchange has given is a security condition, not a calendar date.