Brazilian exchange Mercado Bitcoin halted all deposits and withdrawals on November 2, 2026 after detecting a security issue in one of its systems. A security firm, Hypernative, identified over $40 million worth of dubious transfers spanning at least 10 blockchain networks—but the exchange has not confirmed any losses yet.
In its official statement, Mercado Bitcoin asserted that the incident was contained early in the morning of November 2. Company leadership said no customer funds were harmed and that no personal data appears compromised. The freeze on transactions was a precaution while internal teams conduct investigations, track affected assets, and consult with authorities.
Scope and Breakdown of Transfers
The suspicious outflows were traced to a range of major blockchains including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain, and Stellar. Researchers noted that transfers from Mercado Bitcoin-linked wallets were being moved into new addresses. The movements weren’t limited to one or two networks, but covered at least 10 chains in total.
An investigation into transaction timing shows the bulk of outgoing activity happening during a 34-minute window between 06:19 and 06:53 UTC. Bitcoin transfers reportedly began earlier at around 02:15 UTC, when funds from deposit addresses began being redirected to wallets associated with the suspect. Among the amounts flagged were roughly 106 BTC, 2,852 ETH, 10,700 SOL, 6.7 million XLM, plus over 200 other tokens. These are estimates from researchers, not confirmed by Mercado Bitcoin.
Nature of the Breach and Unanswered Questions
Analysts believe the incident reflects standard wallet transfers rather than an exploit via smart contracts. That suggests the attacker had access to valid signatures—a serious indicator of a possible internal compromise. What remains unclear is exactly how signing keys were accessed, or which part of the infrastructure was compromised. No system, internal or external, has been named so far.
Mercado Bitcoin has released destination addresses on affected blockchains to aid in tracing funds, and is engaging with law enforcement. While the exchange affirms customer funds are safe so far, there’s a distinction between “no harm to customers” and “no loss of assets.” The extent of the damage—if any—has yet to be established.
This episode follows recent crypto wallet breaches at other exchanges, such as the hot-wallet attacks. However, there’s no indication yet that a shared attacker or identical method ties these cases together.
What this means: As decentralized finance and blockchain infrastructure grow, multi-chain exposure means risks multiply. This case underlines the importance of securing key signing mechanisms and implementing strict internal controls. For Mercado Bitcoin, the coming days will be defined by forensic clarity, transparency about affected systems, and whether regulatory or legal scrutiny will follow. Stakeholders in the crypto space should watch how the exchange handles tracing and recovery—and whether these incidents will push for industry-wide standards in wallet security.
