Mercado Bitcoin Faces Massive Security Breach and Ongoing Asset Drain
Brazil's largest exchange suspends operations after hackers siphon nearly $50 million in crypto assets.
1Exchange Operations Halted
Mercado Bitcoin, Brazil’s largest cryptocurrency exchange, suspended all deposits and withdrawals on Monday following a significant security incident. The platform claimed to have identified and contained the breach early in the morning. Despite the company's initial assurances that customer funds remained secure, the exchange halted operations as a precautionary measure.
2Conflicting Damage Estimates
While Mercado Bitcoin initially reported losses, independent security analysts provided varying figures. Hypernative estimated damages near $40 million, while Bitquery analysts later calculated the total loss at $48.6 million. These funds were siphoned across at least 11 different blockchains, including Bitcoin, Ethereum, Solana, Tron, and the BNB Chain.
3Post-Announcement Asset Drain
On-chain data reveals the attacker continued draining assets for four hours after the exchange declared the incident contained. Bitquery reports that unauthorized transfers occurred until 16:56 UTC on November 2, 2026. Specifically, the hacker emptied 36,042 individual client deposit addresses, moving approximately $266,000 in assets during this extended window.
4Sophisticated Attack Mechanism
The breach involved the systematic emptying of hot wallets and thousands of client deposit addresses. Transactions were signed directly by the source wallets, suggesting the attacker gained access to private keys or the exchange's signing infrastructure. This allowed the perpetrator to move funds as if they were authorized by the platform.
5Stablecoin Issuer Interventions
Major stablecoin issuers have taken action to mitigate the theft by blacklisting addresses. Tether CEO Paolo Ardoino confirmed freezing millions in USDT. Total on-chain freezes currently reach approximately $11.8 million, with Tether accounting for $5.9 million, Circle for $4.3 million, and Paxos for roughly $1.5 million of the recovered assets.
6Current Asset Status
The attacker has begun laundering the stolen funds through various services. Reports indicate that 136 different tokens worth $11.9 million were exchanged for ETH via MetaMask. As of the latest analysis, the hacker maintains control over 8,678 ETH across ten wallets, while 106 BTC remains stationary in a separate address.
7Broader Industry Context
This incident follows a record-setting $6.3 billion heist at Binance on October 29, which was attributed to a compromised engineer's laptop. Additionally, the prediction market Polymarket recently disclosed a $2.7 million exploit. These consecutive attacks highlight a period of heightened vulnerability for centralized platforms managing large-scale digital asset reserves.
8Security Implications Ahead
The discrepancy between the exchange's containment claims and the ongoing on-chain activity raises serious questions regarding incident response protocols. As authorities investigate, the focus remains on the unknown entry point of the breach. The industry is now watching how Mercado Bitcoin will address the remaining losses and restore user trust.