Mercado Bitcoin Halts Withdrawals After Security Incident as $40 Million Drain Is Flagged

Published November 2, 2026, 8:50 PM PKT. Based on Unchained's November 2, 2026 report on Mercado Bitcoin's statements and Hypernative's alert, Crypto Briefing's November 2, 2026 report on the exchange's official statement, and crypto.news' November 2, 2026 report on the suspension.

Mercado Bitcoin, Brazil's largest crypto exchange, suspended deposits and withdrawals on Monday, November 2, 2026, after detecting a security incident in one of its systems overnight, the exchange said in an official statement on X at 12:56 UTC. The exchange said it identified and quickly contained the incident, that clients suffered no losses, and that no data had leaked. Its teams are investigating the case, tracking the assets and working with the relevant authorities, the statement said. Blockchain security firm Hypernative, in a preliminary analysis, flagged more than $40 million in suspicious transfers across at least 10 blockchains from wallets it attributes to the exchange, according to Unchained's November 2 report. Mercado Bitcoin has not confirmed Hypernative's figures, has not given a loss figure of its own, has not called the incident a hack, and has not said whose funds moved, Unchained reported. The gap between the two accounts is the story so far: a confirmed service halt and a confirmed containment claim from the exchange, against an unconfirmed but detailed third party tally of money on the move.

The overnight transfers Hypernative flagged

Hypernative described the outflows as plain transfers, not a smart contract exploit, and said it was still unclear how the attacker got signing access, according to an alert shared by Opsek founder Pablo Sabbatella and reported by Unchained. By Hypernative's count, the attacker now holds about 2,852 Ether, 106 Bitcoin, 10,700 Solana and 6.7 million Stellar Lumens, plus more than 200 other tokens, in fresh addresses on at least 10 chains. The firm named nine of the chains: Ethereum, Bitcoin, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain and Stellar. Most of the money moved in a 34 minute window, from 06:19 to 06:53 UTC, Hypernative said, but sweeps of the exchange's Bitcoin deposit addresses to the same attacker had begun earlier, at 02:15 UTC. In Brasilia time, that first activity began at 23:15 on Sunday, November 1. Hypernative has not published a root cause, and no credible attribution to any group has been confirmed, so the mechanism and the actor behind the transfers remain open questions, not established facts.

The Bitcoin address the exchange itself named

About 90 minutes after its first statement, Mercado Bitcoin posted the destination addresses it had identified in movements tied to the incident, covering EVM networks, Bitcoin, Solana, Stellar and Tron, Unchained reported. The exchange said the addresses were shared only so they could be identified and tracked. Unchained then reviewed the named Bitcoin address on the Blockstream block explorer at 14:58 UTC and found it had received about 106.07 Bitcoin across seven transactions, with none of the Bitcoin having left the address at the time of the review. The first transfer landed in a block timestamped 05:42 UTC, and 104.43 Bitcoin of the total arrived in a single transfer timestamped 06:41 UTC, Unchained reported. That on chain check corroborates the scale of the Bitcoin leg in Hypernative's tally, which also put the Bitcoin holding at about 106 Bitcoin, but it does not by itself confirm the full $40 million figure, which spans many chains and tokens the exchange has not itemised.

What Mercado Bitcoin confirmed, and what it has not said

The exchange's own statement is short, and its limits matter as much as its assurances. In Portuguese, it said it identified and contained a security incident in one of its systems overnight, that there was no harm to clients and no data leak, and that deposits and withdrawals were paused as a preventive protection measure, according to the statement quoted by Crypto Briefing. It did not name the affected system, did not say whether any assets were stolen, did not give a timetable for restoring deposits and withdrawals, and did not say whether trading on the platform was affected, crypto.news reported. In a second post, the exchange said it was working to restore operations safely and would keep clients informed through its official channels, Unchained reported. For customers, the immediate, confirmed effect is therefore narrow but real: they cannot move crypto into or out of the platform until the exchange says otherwise. Founded in Sao Paulo in 2013, Mercado Bitcoin has grown into one of Brazil's largest digital asset platforms, with more than 4.8 million clients, Crypto Briefing reported. Tether invested $20 million in the company through a strategic growth financing round announced in July 2026, Crypto Briefing added, a background fact that makes the freeze reports in the next section worth watching, not a confirmed part of this incident.

The freeze reports, still unconfirmed

Local reporting has begun to attach freeze figures to the incident, but the numbers do not yet agree, and neither has been confirmed by Mercado Bitcoin or by Tether in the sources checked for this article. Brazilian outlet BitNoticias reported that Tether froze about $3.7 million linked to the attack, according to a summary of local coverage. A separate flash report put a Tether freeze at 4.5 million USDT linked to the incident. Those two figures may describe the same freeze rounded differently, or two different tranches, and this article does not treat either as settled until Tether or the exchange confirms a number. What is not in doubt is the pattern from the last week: stablecoin issuers have repeatedly frozen funds tied to major incidents, including more than $1.1 billion in USDC frozen by Circle after the October 29 Binance theft, according to Reuters. If a freeze is confirmed here, it would limit how much of the flagged money can move, but it would not by itself prove how much was stolen, or from whom.

Four days after Binance, no link claimed

The incident came four days after billions of dollars drained from Binance's hot wallets on October 29, in what the FBI attributed to North Korea's TraderTraitor group, and MABOnChain has covered that theft, the withdrawal reopening and the reserve verification in full in earlier articles. Neither Mercado Bitcoin nor Hypernative has tied the two events together, Unchained reported, and this article does not link them either. The timing still matters for a different reason: exchanges, regulators and security firms are all operating in the same week of heightened scrutiny, with South Korea's Financial Services Commission ordering emergency checks of domestic exchanges on November 2 after the Binance hack, as MABOnChain reported earlier on Monday. A second major exchange halting withdrawals in the same week, even at a far smaller flagged scale, will test whether that scrutiny produces faster disclosure, or just faster rumours. The next dated facts to watch are a Mercado Bitcoin update with a loss figure or a restoration timetable, a Tether confirmation on any freeze, and a Hypernative update reconciling its $40 million tally with the addresses the exchange itself published.

This article is news reporting and is not investment advice.

Sources

• Mercado Bitcoin, official statement on X, November 2, 2026, 12:56 UTC, and follow-up post publishing destination addresses (primary source: overnight security incident in one system, quick containment, no client losses, no data leak, deposits and withdrawals suspended as a preventive measure, investigation and asset tracing with authorities, work to restore operations safely, as quoted by Crypto Briefing and Unchained)
• Unchained, Mercado Bitcoin Halts Withdrawals Over Security Incident as Hypernative Flags $40 Million Drain (November 2, 2026, secondary source: more than $40 million flagged by Hypernative, 2,852 Ether, 106 Bitcoin, 10,700 Solana, 6.7 million Stellar Lumens, more than 200 other tokens, at least 10 chains, 34 minute window 06:19 to 06:53 UTC, sweeps from 02:15 UTC, plain transfers not a smart contract exploit, signing access unclear, destination addresses posted about 90 minutes after the first statement, Bitcoin address review at 14:58 UTC showing 106.07 Bitcoin in seven transactions, first transfer 05:42 UTC, 104.43 Bitcoin single transfer 06:41 UTC, none left at review, no link to Binance claimed)
• Crypto Briefing, Brazil's top exchange Mercado Bitcoin freezes deposits and withdrawals after security incident (November 2, 2026, secondary source: official statement in Portuguese, swift containment, no customer losses or data breach, investigation with authorities, founded in Sao Paulo in 2013, more than 4.8 million clients, Tether $20 million strategic growth financing round announced in July 2026)
• crypto.news, Brazil's Mercado Bitcoin reports security incident, freezes withdrawals (November 2, 2026, secondary source: suspension of deposits and withdrawals after a November 2 security incident, no affected system disclosed, no timetable for restoration, no statement on whether trading was affected)