Mercado Bitcoin Hack: $40M Drained in 34 Minutes Across 10 Chains — 7 Checks If Your Exchange Freezes Withdrawals

Brazil's largest crypto exchange says no customer lost a cent. Blockchain researchers traced more than $40 million leaving wallets attributed to that same exchange in just 34 minutes, across at least 10 blockchains. Both statements can be true at once — and the gap between them is exactly why this story matters for anyone holding coins on any exchange.

On Monday, November 2, 2026, Mercado Bitcoin confirmed a security incident in one of its systems, contained it overnight, and suspended deposits and withdrawals as a precaution. Blockchain security firm Hypernative flagged the suspicious transfers first: 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and more than 200 other tokens, swept into fresh attacker-controlled addresses. The exchange has not confirmed Hypernative's figures, has not named the compromised system, and has given no timeline for reopening withdrawals. This article explains what is confirmed, what is still only researcher estimates, whose money may actually have moved, and the seven checks you should run today if any exchange you use ever freezes withdrawals.

What Happened at Mercado Bitcoin on November 2

Mercado Bitcoin is Brazil's largest cryptocurrency exchange, and the incident unfolded in the early hours of Monday morning. According to Hypernative's preliminary analysis, the first suspicious sweeps of its Bitcoin deposit addresses began at around 02:15 UTC, and the heaviest movement came between 06:19 and 06:53 UTC, when assets moved across multiple chains toward attacker addresses. That 34-minute window is the detail that should worry every exchange user: this was not a slow leak discovered weeks later, but a fast, coordinated drain executed while most of Brazil was asleep.

The exchange's own statement, posted on X at 12:56 UTC on November 2, was short and written in Portuguese. Translated, it said the company had identified and quickly contained a security incident in one of its systems overnight, that there was no loss to clients, that no data had leaked, and that deposits and withdrawals were temporarily suspended as a preventive measure while teams investigated, traced assets and coordinated with the competent authorities. It did not call the event a hack, did not publish a loss figure, and did not say whose funds moved.

About 90 minutes after that first statement, Mercado Bitcoin published destination addresses it had identified in movements tied to the incident, covering EVM networks, Bitcoin, Solana, Stellar and Tron, so that other exchanges and monitoring services could flag the funds. An Unchained review of the named Bitcoin address on the Blockstream explorer at 14:58 UTC found about 106.07 BTC had arrived across seven transactions, including a single transfer of 104.43 BTC at 06:41 UTC, and that none of it remained there by the time of the review.

The $40 Million Question: Whose Money Actually Moved?

Here is the uncomfortable question at the heart of this story. If more than $40 million left wallets attributed to Mercado Bitcoin, how can the exchange also say no client lost money? There are several honest answers, and until Mercado Bitcoin publishes its final assessment, none of them can be confirmed.

One possibility is that the moved funds belonged to the exchange itself — corporate treasury or operational wallets rather than segregated customer deposits. Many large exchanges hold their own assets in hot wallets alongside customer funds for liquidity, and a compromise of an operational wallet would drain company money while leaving customer balances technically untouched. A second possibility is that customer funds did move, but the exchange intends to make customers whole from its own reserves, which would make "no loss to clients" a promise about the outcome rather than a description of what happened. A third possibility is that some of the flagged transfers were internal movements misattributed by researchers, though the pattern of funds landing in fresh addresses and then moving on makes that explanation harder to sustain for the full amount.

What we know for certain is narrower: Hypernative's figures are preliminary researcher estimates, not amounts verified by Mercado Bitcoin, and the attribution of the wallets to the exchange has not been independently verified in every report. Responsible coverage keeps those two facts attached to the $40 million number every time it is used. What is not in doubt is that deposits and withdrawals were suspended, that the exchange confirmed a security incident, and that a large, fast, multi-chain outflow was flagged by a credible security firm within hours.

This distinction matters beyond Brazil. Exchange statements after incidents are written by lawyers as much as by engineers. "No client losses" can mean no customer balances were touched, or it can mean customers will be reimbursed. "Contained" can mean the attacker lost access, or it can mean the bleeding stopped because wallets were emptied. Until a final report names the compromised system and the affected wallets, treat every reassurance as provisional — and act as if your own exchange could be next.

Why "Plain Transfers" Is the Scariest Detail

Hypernative described the outflows as plain transfers, not a smart contract exploit. That single detail changes the whole threat model. A smart contract exploit means buggy code was abused; the fix is an audit, a patch and a redeployed contract. Plain transfers mean someone obtained signing access — private keys, a compromised signer, an insider credential, or a hijacked approval workflow — and simply told the wallets to send money to new addresses. There is no code to patch, only access controls to rebuild.

It also means the usual post-hack playbook does not apply. There is no vulnerable contract to pause, no DeFi protocol to negotiate a white-hat bounty with, and no obvious on-chain mechanism to freeze the funds. The only levers are off-chain: exchanges flagging the destination addresses, investigators tracing the money through mixers and swaps, and law enforcement pressuring off-ramps. Mercado Bitcoin's publication of destination addresses was exactly the right move for that reason — it turns every other exchange into a checkpoint.

The multi-chain spread makes tracing harder still. Funds were flagged on Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain and Stellar, at least 10 chains in total. Each hop across a bridge or a swap is another chance for the trail to blur, and researchers noted more than 200 different tokens involved. That breadth suggests preparation: the attacker did not stumble into one wallet, but mapped the exchange's footprint across its whole infrastructure before moving.

Four Days After Binance: A Pattern or a Coincidence?

The Mercado Bitcoin incident came just four days after billions of dollars drained from Binance's hot wallets on October 29, an attack the FBI attributed to North Korea's TraderTraitor group. Neither Mercado Bitcoin nor Hypernative has tied the two events together, and this article does not link them either — but the timing forces an uncomfortable question for the whole industry: are exchange hot wallets facing a coordinated campaign, or is this simply what a bad week looks like when attackers share tools and targets?

There are real differences. The Binance theft was vastly larger, measured in billions, and Binance said it covered $6 billion of the loss with internal funds and froze $3 billion of the stolen assets. The Mercado Bitcoin incident is measured, on current estimates, in tens of millions, and the exchange has said nothing about covering losses from reserves. The Binance case involved a named state-linked actor; the Mercado Bitcoin case has no attributed attacker at all. But there is one shared lesson: in both cases, the first reliable numbers came from outside researchers, not from the exchange, and users learned the scale of the event from blockchain data before they heard it from the company holding their money.

That pattern — researchers first, exchange statement second, final report much later or never — is now the norm for exchange incidents. It means your early-warning system cannot be the exchange's own status page. It has to be independent: security researchers on X, blockchain monitoring alerts, and your own withdrawal test before you need one.

What the Numbers Look Like Side by Side

To keep the scale honest, here is what has been reported so far, with the status of each figure stated plainly.

Data point	Figure	Status
Suspicious transfers flagged	More than $40 million	Hypernative preliminary estimate, not confirmed by the exchange
Ether flagged	2,852 ETH	Hypernative preliminary estimate
Bitcoin flagged	106 BTC (106.07 BTC in the named address)	Hypernative estimate; address review corroborated the BTC amount
Solana flagged	10,700 SOL	Hypernative preliminary estimate
Stellar flagged	6.7 million XLM	Hypernative preliminary estimate
Other tokens flagged	More than 200 tokens	Hypernative preliminary estimate
Blockchains involved	At least 10	Hypernative preliminary analysis
Main drain window	06:19 to 06:53 UTC, 34 minutes	Hypernative timeline, reported by multiple outlets
First sweeps observed	02:15 UTC	Hypernative timeline
Client losses	None, according to the exchange	Mercado Bitcoin statement, November 2
Data leak	None, according to the exchange	Mercado Bitcoin statement, November 2
Deposits and withdrawals	Temporarily suspended	Confirmed by the exchange, no reopening timeline given

Read that table as a snapshot of a developing story, not a final verdict. The figures that matter most — the final loss amount, the compromised system, and whose funds moved — are precisely the ones still missing.

7 Checks to Run the Moment Any Exchange Freezes Withdrawals

You cannot control whether your exchange gets hacked. You can control how exposed you are when it happens, and the first hours of a withdrawal freeze are when good preparation pays off. Run these seven checks now, while your exchange is working normally, so you are not learning them during a crisis.

1. Test a small withdrawal today, before you need one. A withdrawal freeze you discover during an emergency is a freeze you cannot plan around. Send a small amount to your own wallet now and confirm it arrives. If withdrawals are slow, capped or quietly disabled, you want to know that on a calm Tuesday, not during a hack.
2. Keep only trading money on exchanges. Anything you are not actively trading belongs in a wallet you control. Our guide to the best crypto wallets for beginners explains the difference between hot and cold storage, and our November ranking of hardware wallets covers the devices that keep keys offline entirely.
3. Verify your backup before you move anything. A seed phrase you have never tested is a hope, not a backup. Write it on paper, store it offline, never photograph it or save it in the cloud, and confirm you can restore a wallet from it with a tiny amount first. If you are new to the basics, start with our beginner's guide to Bitcoin before moving larger sums.
4. Follow independent researchers, not just the exchange. In both the Binance and Mercado Bitcoin cases, the first credible numbers came from firms like Hypernative and from on-chain analysts, hours before official detail. Build a small list of security researchers and monitoring accounts now, and check them first when an exchange goes quiet.
5. Read the exchange's proof of reserves — and its limits. Proof-of-reserves reports show assets at a single moment; they do not prove liabilities, segregation of customer funds, or that hot-wallet signing keys are safe. Treat a clean report as a good sign, never as a guarantee, and be wary of exchanges that publish reserves but never submit to a full audit.
6. Split across venues and wallets. Holding everything on one exchange means one incident is a total loss of access. Spreading funds across two reputable exchanges and your own wallet turns a single freeze into an inconvenience. The same logic applies to stablecoins: do not hold your entire cash position in one issuer's token on one platform.
7. Have a written exit plan for a freeze. Decide in advance: at what point do you stop depositing, when do you withdraw everything, and where does it go? Write down your wallet addresses and the steps in a note you can follow under stress. Our guide on how to buy Bitcoin safely after the Binance hack and our explainer on what happens to your crypto if an exchange goes bankrupt both cover the decisions people get wrong in the first 24 hours.

What Most People Get Wrong About Exchange Hacks

The biggest misconception is that a hack means your coins were stolen from your account. In most large exchange incidents, individual user accounts are not breached at all — the exchange's own hot wallets are drained, and users discover the problem only when withdrawals stop. That is why strong passwords and two-factor authentication, essential as they are, would not have saved anyone at Mercado Bitcoin or Binance. Your account security protects you from someone logging in as you; it does nothing about someone holding the exchange's own signing keys.

The second misconception is that "no client losses" means nothing happened. As explained above, it can mean the exchange absorbed the loss, plans to reimburse users, or holds customer funds separately from the drained wallets. All three are better than the alternative, but only the third means customer money was never at risk — and exchanges rarely publish the wallet-level evidence that would prove it.

The third misconception is that bigger exchanges are automatically safer. Binance is the world's largest exchange by volume, and it still lost billions in a single incident. Mercado Bitcoin is Brazil's largest exchange, and it still suffered a multi-chain drain. Scale buys better incident response and deeper reserves to cover losses; it does not buy immunity. The safety question is never "how big is this exchange" but "how much of my money sits in wallets someone else controls, and what happens if those wallets are emptied?"

What to Watch Next

Five developments will determine how this story ends. First, whether Mercado Bitcoin reopens deposits and withdrawals, and whether reopening comes with limits or a phased schedule. Second, whether the exchange publishes a final loss figure and names the compromised system — silence on either point after a week should be read as a warning, not as reassurance. Third, whether any flagged funds move to known exchanges or off-ramps, testing whether the published destination addresses actually freeze anything. Fourth, whether Brazilian regulators comment, since the case may shape local rules. Fifth, whether other exchanges quietly tighten hot-wallet limits or rotate signing keys — the industry's silent reaction often reveals more than its public statements.

For users, the practical watchpoint is simpler: if you hold funds on Mercado Bitcoin, do not deposit more until withdrawals demonstrably work again, keep records of your balances with screenshots and transaction histories, and be deeply suspicious of anyone contacting you claiming to help recover funds — recovery scams follow every major hack within hours, and no legitimate exchange will ever ask for your seed phrase.

Frequently Asked Questions

Was Mercado Bitcoin hacked?

Mercado Bitcoin confirmed a security incident in one of its systems on November 2, 2026, and suspended deposits and withdrawals. It has not called the event a hack and has not confirmed Hypernative's loss figures. Researchers flagged more than $40 million in suspicious transfers from wallets attributed to the exchange, but the exchange's own final assessment has not been published.

Did customers lose money in the Mercado Bitcoin incident?

According to Mercado Bitcoin's November 2 statement, there was no loss to clients and no data leak. That statement has not been independently verified, and the exchange has not yet said whether the moved funds belonged to customers or to the exchange itself. Until a final report is published, treat the claim as provisional.

How much was taken from Mercado Bitcoin?

Hypernative's preliminary estimate is more than $40 million across at least 10 blockchains, including 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and more than 200 other tokens. These are researcher estimates, not confirmed losses, and Mercado Bitcoin has not published its own figure.

Are Mercado Bitcoin deposits and withdrawals working again?

As of the exchange's November 2 statement, deposits and withdrawals were temporarily suspended with no reopening timeline given. Check the exchange's official channels for the latest status before depositing anything, and test a small withdrawal before moving larger amounts.

Is my crypto safe on other exchanges after this hack?

No exchange is immune, as the Binance theft four days earlier showed. The safest approach is to keep only trading funds on exchanges and move long-term holdings to a wallet you control, with your seed phrase backed up offline. Review our beginner's wallet guide and the post-Binance safety checklist before your next transfer.

What should I do if my exchange freezes withdrawals?

Stop depositing immediately, screenshot your balances and transaction history, follow independent security researchers for updates, and never share your seed phrase with anyone claiming to help you recover funds. If you have funds on other exchanges, consider moving long-term holdings to self-custody while the situation is unclear.

Conclusion

The Mercado Bitcoin incident is still a developing story, and honest coverage has to say so. What is confirmed: Brazil's largest exchange suffered a security incident on November 2, suspended deposits and withdrawals, and says no client lost money or data. What is strongly indicated but not confirmed by the exchange: more than $40 million moved out of attributed wallets in 34 minutes across at least 10 chains, through plain transfers that point to compromised signing access rather than a smart contract bug. What is missing: the final loss figure, the compromised system, whose funds moved, and a reopening date.

That uncertainty is the real lesson. You cannot wait for a perfect post-mortem to protect yourself, because post-mortems arrive weeks later, if at all, and your funds are exposed in the meantime. Run the seven checks in this article today: test a withdrawal, move long-term holdings to a wallet you control, verify your backup, follow independent researchers, read proof-of-reserves reports sceptically, split across venues, and write down your exit plan. Sources: Unchained's report on the incident and Hypernative's findings, ETHNews coverage of the breach, CryptoRank's report, and Cybersecurity News on the attack timeline.