Brazil's Largest Crypto Exchange Mercado Bitcoin Halts Withdrawals After $40 Million Hack
Key Takeaways
- •Mercado Bitcoin, Brazil's largest crypto exchange, halted deposits and withdrawals as a preventive measure after identifying and containing a security incident, stating that no customer lost money and no data was leaked.
- •Blockchain security firm Hypernative flagged more than $40 million in suspicious transfers potentially linked to the incident, spanning at least 10 blockchains including Bitcoin, Ethereum, Solana, and Tron.
- •The exchange publicly disclosed destination addresses on five networks—EVM chains, Bitcoin, Solana, Stellar, and Tron—so that others can identify and track the funds on-chain.
- •Tether CEO Paolo Ardoino announced that the stablecoin issuer froze more than 4.5 million USDT connected to the security incident.
- •The breach occurred days after hackers drained more than $6 billion from Binance on October 29, a theft the FBI attributed to North Korea's TraderTraitor group, though Mercado Bitcoin has not connected the two incidents.

Brazil's largest crypto exchange, Mercado Bitcoin, suspended deposits and withdrawals on Monday after identifying a security incident in one of its systems in the early hours of the morning. The company said no customer lost money and no data was leaked. Suspensions of this kind are a routine protective measure while an exchange investigates a suspected breach.
"We identified and quickly contained a security incident in one of our systems early this morning," the exchange said in a Portuguese-language statement on X. "As a preventive protection measure, deposits and withdrawals are temporarily suspended."
Comunicado oficial: Identificamos e contivemos com rapidez um incidente de segurança em um de nossos sistemas nesta madrugada. Reforçamos que: • Não houve nenhum prejuízo aos clientes; • Não houve vazamento de dados. Como medida preventiva de proteção, depósitos e saques…
— Mercado Bitcoin (@MercadoBitcoin) November 2, 2026
Blockchain security firm Hypernative flagged more than $40 million in suspicious transfers that may be linked to the incident, according to a preliminary analysis spanning at least 10 blockchains, including Bitcoin, Ethereum, Solana, and Tron. Mercado Bitcoin has not confirmed that figure and has not disclosed how the attackers gained access to its systems. Transfers spread across that many networks must be monitored chain by chain, since each blockchain keeps an independent ledger and movements on one are not recorded on the others.
In a follow-up post, the exchange published the destination addresses it had identified on five networks: EVM chains (blockchains built to run the same code as Ethereum), Bitcoin, Solana, Stellar, and Tron. The company said the addresses were made public only so that others can identify and track the funds on-chain. Publicizing addresses tied to a theft is a common on-chain tracking measure, since analytics firms and exchanges routinely screen incoming transactions against addresses linked to known incidents.
Tether CEO Paolo Ardoino said in a post on X that the stablecoin issuer has frozen more than 4.5 million USDT connected to the incident. USDT is a dollar-pegged stablecoin, and Tether can blacklist the addresses holding it so the tokens cannot be moved, though a freeze does not by itself return the funds to their owner.
Tether froze more than 4.5M USDT related to this security incident.
— Paolo Ardoino 🤖 (@paoloardoino) November 2, 2026
The incident comes days after hackers drained more than $6 billion from Binance on October 29, a theft the FBI attributed to North Korea's TraderTraitor group. Binance has since reopened withdrawals and said it replenished about 95% of the affected assets. Mercado Bitcoin has not linked the two incidents and has not said who is behind its own.
Deposits and withdrawals at Mercado Bitcoin remain suspended, and the exchange has not given a date for resuming them. The company said it will post regular updates on X. The open questions to watch are whether the exchange confirms Hypernative's $40 million estimate, discloses how its systems were compromised, and sets a timeline for restoring deposits and withdrawals.
Source: Decrypt