Mercado Bitcoin Hacked Across 10 Chains, $40M in Suspicious Outflows

Brazil's largest crypto exchange suspended deposits and withdrawals after a cyberattack drained wallets on at least 10 blockchains, four days after the $6.3 billion Binance hack.

Key takeaways

• Mercado Bitcoin halted all deposits and withdrawals on November 2 after wallets across at least 10 blockchains were compromised; blockchain security firm Hypernative estimates $40M+ in suspicious outflows, a figure the exchange has not confirmed.
• Tether CEO Paolo Ardoino confirmed $4.5M in USDT linked to the incident has been frozen, the only externally verified recovery figure published so far.
• Mercado Bitcoin claims no customer funds were lost and no data was breached, but the compromised system has not been identified and withdrawals remain suspended, leaving customers dependent on the exchange's word.

Mercado Bitcoin, Brazil's largest cryptocurrency exchange, suspended all deposits and withdrawals on November 2, 2026, after a cyberattack drained wallets spanning Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC, Stellar, Bitcoin, and other EVM networks. Blockchain security firm Hypernative flagged the outflows and estimates more than $40 million left exchange-controlled addresses, though Mercado Bitcoin has not confirmed that number.

The bulk of suspicious transfers occurred in a concentrated 34-minute window, approximately 06:19 to 06:53 UTC, per security researcher Pablo Sabbatella of Opsek. Mercado Bitcoin posted a statement on its official X account (@MercadoBitcoin) at 12:56 UTC, per Unchained Crypto: "Identificamos e contivemos com rapidez um incidente de segurança em um de nossos sistemas nesta madrugada." (Translation: "We identified and swiftly contained a security incident in one of our systems overnight.") A follow-up post listed destination addresses across EVM chains, Bitcoin, Solana, Stellar, and Tron. How the attacker obtained signing access remains unknown. No threat actor has been identified.

Tether CEO Paolo Ardoino confirmed on X (@paoloardoino) that $4.5M in USDT linked to the incident has been frozen, the only externally verified recovery number available at time of publication. First reported by CoinDesk.

Ten Chains, One Point of Failure

The $40M+ figure from Hypernative reflects suspicious transfer volume from wallets attributed to the exchange, not confirmed customer account losses. The gap between those two things matters. Exchange hot wallets routinely hold operational and settlement capital separate from segregated customer funds. Whether the drained wallets held customer assets or exchange-controlled operational funds is exactly what Mercado Bitcoin's post-mortem needs to answer.

What the exchange has offered so far: no customer assets lost, no customer data compromised, incident "contained." What it has not offered: which system was breached, how signing keys were obtained, or any proof-of-reserves update to independently verify the customer-funds claim. Customers are currently taking the exchange's word for it, which is the definition of counterparty risk.

The attack surface here is structural. Mercado Bitcoin's wallets spanned at least 10 separate blockchain networks simultaneously. Every chain an exchange supports requires its own key management infrastructure, and every piece of that infrastructure has to be secure at the same time. Supporting 10 chains means maintaining 10 parallel keystores, any one of which can be the entry point. The Binance hack published earlier this week laid out the same failure mode in detail: unified signing infrastructure across many chains creates a single-lever catastrophic exit for a sophisticated attacker.

The Binance hack on October 29 drained wallets across 10 blockchains in roughly 20 minutes and totaled $6.3 billion, the largest crypto theft on record, attributed by the FBI to North Korea's TraderTraitor group. Mercado Bitcoin's outflows also hit across at least 10 chains in a 34-minute window. There is no public evidence linking the two incidents, and no threat actor has been named in the MB case.

The methodological and numeric overlap is worth watching. It may be coincidence. It may also be that multi-chain hot wallet infrastructure is under active, coordinated targeting right now.

Hot wallets connected to live infrastructure are the attack surface. The more chains you add, the wider it gets.

What Comes Next

Mercado Bitcoin needs to publish a full post-mortem that identifies the breached system, confirms whether the $40M+ left customer-segregated wallets or exchange-controlled operational accounts, and provides an updated proof-of-reserves attestation. Until that document exists, the "no customer losses" claim is unverifiable.

The falsifiable thesis here is straightforward: if Mercado Bitcoin's post-mortem shows that the drained wallets were exclusively exchange-controlled operational capital, that no customer-segregated funds were touched, and that the custody architecture itself was not compromised, the multi-chain custodial risk argument as applied to this specific incident loses significant force. That outcome would shift the story from a customer-loss event to a hot-wallet operational failure. Watch for the post-mortem.

Brazil is one of the highest Bitcoin-adoption jurisdictions in the world. When the region's largest exchange freezes withdrawals, it damages the on-ramp layer at exactly the wrong time.

Anyone sitting on a Brazilian exchange right now should move to a hardware wallet and transfer out the moment withdrawals reopen.

Sources

• Mercado Bitcoin (@MercadoBitcoin) on X
• Paolo Ardoino (@paoloardoino) on X
• FBI attribution of Binance hack to TraderTraitor/North Korea, per NBC News
• First reported by CoinDesk