On November 2, 2026, the Brazilian cryptocurrency platform Mercado Bitcoin suspended both deposits and withdrawals due to a security breach detected in one of its systems. This was followed by an immediate halt to services as the company worked to address the situation.
Investigation into Suspicious Transfers
Blockchain security experts at Hypernative identified over $40 million in questionable transactions spanning at least ten different blockchains. Although this amount is yet to be confirmed as the actual loss by the exchange, it has raised significant concerns regarding the breach’s extent.
Mercado Bitcoin, in a formal announcement, indicated that they promptly managed to contain the issue early Monday. The exchange emphasized that no customer data was compromised, and the temporary halt was purely a precautionary measure to ensure further security while investigations are ongoing.
Details of the Incident
Reports from Opsek’s founder, Pablo Sabbatella, highlighted movements from Mercado Bitcoin-related wallets to new addresses. The affected networks include prominent names such as Bitcoin, Ethereum, Solana, Tron, and others, comprising at least ten blockchain networks in total.
The majority of asset transfers were noted between 06:19 and 06:53 UTC, with initial activities involving Bitcoin starting around 02:15 UTC. During this period, approximately 2,852 ETH, 106 BTC, 10,700 SOL, and 6.7 million XLM, along with over 200 other tokens, were reportedly moved. These figures remain estimates by researchers and have not been verified by Mercado Bitcoin.
Broader Industry Context
The nature of these transactions suggests they were straightforward transfers rather than the result of a smart contract vulnerability. This has led to further inquiries into how the attackers gained access to necessary signing credentials and which systems were potentially compromised.
This incident is reminiscent of previous cryptocurrency exchange breaches, such as the Bitget hot wallet hack, which similarly involved unauthorized transfers. However, there is no current evidence to suggest a link between these incidents.
To assist in tracking and recovering the assets, Mercado Bitcoin has shared destination addresses across Ethereum-compatible networks and other blockchains. This transparency is part of a broader effort to trace the movements of these funds, akin to strategies used in past high-profile investigations like the Bitfinex case.
As the situation unfolds, Mercado Bitcoin has yet to announce when services will resume or disclose specific details about the compromised system. While the exchange maintains that customer safety has been prioritized, the full impact of the breach is still being assessed.
