Mercado Bitcoin Says Customers Will Not Take the Loss From Its Security Breach

Mercado Bitcoin has put the most important promise in writing: customers will not be forced to absorb losses from the security incident that hit the Brazilian exchange this week.

That is a much stronger commitment than the usual “investigation is ongoing” language that follows a crypto breach. It shifts the immediate question from whether customer balances are whole to how the exchange, investigators and industry partners recover the stolen assets.

Decrypt reports that Mercado Bitcoin, Brazil’s largest crypto exchange, said users would be reimbursed after roughly $40 million was taken. The incident was identified early on November 2, and the exchange temporarily restricted deposits and withdrawals while activating security protocols.

The company contacted authorities and began tracing funds while keeping customer balances recorded in their accounts. Its public statements separate the exchange’s own incident loss from the amount owed to customers, making full reimbursement the central promise of the response.

Mercado Bitcoin’s own update says customer assets are guaranteed and account balances remain recorded. That distinction matters.

An exchange can face a serious treasury loss without passing that loss directly to customers, provided it has the capital and liquidity to honor every balance.

Olá.

Primeiro, o mais importante: os ativos dos clientes estão garantidos . Os saldos continuam registrados nas respectivas contas.

Ontem (2/11), identificamos um incidente de segurança. Acionamos na hora nossos protocolos de segurança e governança e informamos as autoridades.…

— Mercado Bitcoin (@MercadoBitcoin) November 3, 2026

The response has already produced a meaningful recovery result. In a detailed incident account, Chainalysis says the attacker moved an estimated $49 million across 17 blockchains, with the largest portions coming from Bitcoin and Ethereum.

The analytics firm says a team working across three continents coordinated with Mercado Bitcoin, law enforcement and industry partners to freeze nearly $10 million.

That account also explains why speed matters. Centrally issued stablecoins can sometimes be frozen before an attacker converts them into assets such as Bitcoin or Ethereum that are harder to stop.

Chainalysis says a Mercado Bitcoin director called at 2:30 a.m. Eastern, allowing investigators to begin mapping unauthorized transactions during the first hours of the incident.

Mercado Bitcoin had already told users on November 2 that they would not lose assets because of the breach. The newer statement reinforces that commitment rather than softening it.

Atualização sobre o incidente: o Mercado Bitcoin assegura que você não terá nenhuma perda de ativos em razão do incidente de segurança que identificamos hoje em nossa plataforma.

Identificamos uma ocorrência em nossa plataforma na madrugada de hoje. Como medida preventiva para…

— Mercado Bitcoin (@MercadoBitcoin) November 2, 2026

The exchange still has work ahead. Customers will want a precise accounting of what was taken, how the compromise occurred, which services are fully restored and what controls have changed.

A reimbursement promise is only as good as the exchange’s ability to execute it promptly and transparently.

Still, the early combination of a customer-loss guarantee and a nearly $10 million freeze is an encouraging response to a bad event. Crypto firms cannot promise that attacks will never happen.

They can prove whether their reserves, controls and incident teams are strong enough to protect customers when one does.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.