Mercado Bitcoin Halts Deposits and Withdrawals After Security Incident

Mercado Bitcoin temporarily halted deposits and withdrawals after the Brazilian crypto exchange identified and contained a security incident in one of its systems.

The exchange said customers did not suffer losses and that no personal data was exposed. Outside blockchain analysts, however, flagged tens of millions of dollars in suspicious transfers across multiple networks, leaving an important gap between what has been observed on-chain and what the company has formally confirmed.

What Mercado Bitcoin has confirmed

Mercado Bitcoin said the incident was detected during the early hours of November 2 and quickly contained. Deposits and withdrawals were paused as a protective measure while the company investigated, traced moved assets, and coordinated with authorities and industry partners.

The company’s public statement was direct on two points: it said customers would not absorb losses, and it said customer data had not leaked.

Comunicado oficial:

Identificamos e contivemos com rapidez um incidente de segurança em um de nossos sistemas nesta madrugada.

Reforçamos que:
• Não houve nenhum prejuízo aos clientes;
• Não houve vazamento de dados.

Como medida preventiva de proteção, depósitos e saques…

— Mercado Bitcoin (@MercadoBitcoin) November 2, 2026

Mercado Bitcoin had not publicly described the attack method or confirmed a final loss figure when the first reports appeared. Those remain the central unanswered questions.

Independent trackers saw suspicious transfers across several chains

Cointelegraph reported that blockchain investigators traced transfers associated with the incident after assets moved from wallets linked to the exchange. The first estimates varied as analysts followed activity across a wide set of networks.

One investigator mapped activity across 17 chains and said the movement began on smaller networks before the main hot wallets were emptied. The transfers later extended to thousands of customer deposit addresses, adding complexity to the first loss estimates.

The reporting placed the suspected total near the mid-$40 million range, but those numbers were still moving as researchers labeled addresses and separated exchange-controlled transfers from attacker-controlled ones. Mercado Bitcoin had not adopted that figure publicly.

The exchange’s operational response was clearer than the accounting. Deposits and withdrawals were stopped while teams traced assets and coordinated with authorities, reducing the chance that an affected authorization path could continue sending funds.

Wu Blockchain, citing preliminary analysis from blockchain security firm Hypernative, reported more than $40 million in suspicious transfers across at least 10 chains, including Bitcoin, Ethereum, Solana, and Tron.

Brazil's Largest Crypto Exchange Mercado Bitcoin Confirms Cyberattack; Hypernative Estimates Over $40M in Suspected Losses @MercadoBitcoin, Brazil's largest cryptocurrency exchange, confirmed on November 2 that one of its systems had suffered a cyberattack. The exchange said… pic.twitter.com/DT10II5PgK

— Wu Blockchain (@WuBlockchain) November 2, 2026

Those figures should be treated as outside estimates, not as a confirmed company loss. CNN Brasil’s local reporting likewise noted that the exchange had not published its own amount while saying teams were tracing the assets and working with authorities.

The distinction matters. On-chain movements can show where assets traveled, but they do not automatically prove who owned every moved balance, whether funds were recovered, or what final loss will appear on the company’s books.

A withdrawal pause is the correct first move—but not the final answer

Stopping deposits and withdrawals is disruptive, especially for customers who need access to their funds. It is also the expected containment step when an exchange believes a system capable of authorizing transfers may be compromised.

The immediate job is to prevent further movement, preserve evidence, rotate or revoke affected credentials, and determine which systems can still safely sign transactions. The next job is transparency.

Customers need a clear timeline, a precise accounting of affected wallets, confirmation that reserves remain intact, and a credible explanation of how services will restart.

A promise that customers will be protected is valuable. Verifiable proof of what happened and what changed is better.

The timing raises the pressure on every exchange

The Mercado Bitcoin incident arrived only days after the record Binance theft forced the industry to confront exchange infrastructure risk on an unprecedented scale. There is no public evidence that the two incidents are connected.

The proximity changes the market’s tolerance for vague security updates. Customers have just watched a much larger exchange freeze services, trace funds across chains, and race to rebuild confidence.

Every platform now faces the same basic question: can it prove that a contained incident is truly contained?

For Mercado Bitcoin, the answer will depend on the evidence that follows the first statement. The important milestones are a safe restoration of deposits and withdrawals, an independently checkable accounting of any lost or recovered assets, and a technical postmortem detailed enough to show that the original path is closed.

Until then, the exchange’s assurances and the outside transfer estimates should be kept in separate columns. One is the company’s commitment to customers.

The other is an evolving on-chain investigation. The final picture will require both.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.