Brazilian crypto exchange Mercado Bitcoin suspended deposits and withdrawals on Monday after wallets tied to the platform were drained across at least 10 blockchains. The exchange puts the value of the assets involved at about $38 million. Security firms estimate the loss at more than $40 million.

What the exchange has said

Mercado Bitcoin first addressed the incident on X on Nov. 2.

"We identified and swiftly contained a security incident in one of our systems early this morning," the exchange wrote.

It said there was no harm to customers and no data breach.

Later updates were more specific. The company said it had blocked $11 million with help from Tether, Circle, Paxos, BRL1 and Chainalysis. It added that "other amounts eligible for blocking have been identified" and that containment efforts continue. It also repeated that customers "will not suffer any loss of assets" because of the incident.

The exchange has given no restart date.

"Deadlines will be communicated exclusively through our official channels," it said.

How the funds moved

Pablo Sabbatella, founder of crypto security firm Opsek, relayed a report that the largest outflows hit between 06:19 and 06:53 UTC. In that window, wallets on Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC, Stellar and other chains sent most of their funds to fresh addresses.

According to the same report, the attacker now holds roughly 2,852 ETH and 106 BTC, along with 10,700 SOL. It also lists 6.7 million XLM, 77,000 AVAX and more than 200 other tokens. The transfers were plain transactions, not a smart contract exploit. How the attacker got signing access is unknown.

Mercado Bitcoin published the destination addresses it identified on EVM chains, Bitcoin, Solana, Stellar and Tron. It said they were disclosed "exclusively for identification and tracking purposes."

A plain transaction means the network accepted a valid signature. That usually points to compromised keys or signing systems, not a flaw in code. The $1.5 billion Bybit theft in February 2025 followed a similar pattern, with attackers tampering with the signing process and not the blockchain itself.

Freezes recover only part of the funds

Tether CEO Paolo Ardoino confirmed that $4.5 million worth of USDT linked to the hack has been frozen. That amount sits inside the larger $11 million the exchange says it has blocked with its partners.

Stablecoin issuers such as Tether and Circle can freeze tokens because they control the token contracts. Native assets like bitcoin, ether and SOL have no issuer, so those stolen funds can be stopped only if exchanges and other services refuse the deposits. This is why attackers often swap into those assets quickly.

The two figures for the total loss differ. The exchange says about $38 million was involved, while security firms put the loss above $40 million. Neither has published a full breakdown.

A second major exchange incident in days

The attack on Mercado Bitcoin comes days after the FBI said North Korea's TraderTraitor group stole more than $6 billion from Binance, the largest crypto hack on record. No one has attributed the Mercado Bitcoin incident to a group, and there is no public evidence linking it to the Binance attack.

Mercado Bitcoin was founded in Brazil in 2013 and is one of the largest exchanges in Latin America. Brazil's central bank issued rules in November 2025 that bring crypto service providers under its supervision, with the framework taking effect in February 2026.

Mercado Bitcoin says its teams are investigating the case, tracking the assets and coordinating measures with the competent authorities. It says it will keep posting updates on its official X account.

Binance Breach: What We Know about the $6.3B Theft | HODL FM NEWS
Binance says about $6.3 billion was stolen in an Oct. 29 breach and $3 billion is frozen. Here is what is known about the cause and who researchers blame.
hodl-post-imageHODL FM News: The Wildest Ride in the Crypto MarketGunel Ismayilova
hodl-post-image

Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Cryptocurrency investments involve significant risk of loss. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.