Mercado Bitcoin, by its own account and according to the trade press Brazil's largest crypto exchange, confirmed a cyberattack on one of its systems on Monday, November 2, 2026, and suspended
Mercado Bitcoin, by its own account and according to the trade press Brazil's largest crypto exchange, confirmed a cyberattack on one of its systems on Monday, November 2, 2026, and suspended all deposits and withdrawals for the time being. According to reporting by Cointelegraph, crypto assets worth more than $46 million flowed out of the exchange's wallets. The exchange itself says its customers have suffered no harm. Anyone holding a balance at Mercado Bitcoin still cannot get at their money for now.
For investors in Europe the case matters for a different reason: it is the second major attack on a centralised crypto exchange within a week. It shows once again how quickly a balance on a trading platform can be frozen, even if in the end nobody bears a loss.
In its statement on X, the exchange writes that the incident was detected in the early hours of the morning and quickly contained. Customer funds were not affected, it says, and there was no data leak. Mercado Bitcoin describes the halt to payments as a precaution. Its own teams are investigating the incident, tracing the drained assets and coordinating with the authorities.
A spokesperson repeated to Cointelegraph that customers had suffered no losses and that no data had leaked. According to the report, the company did not respond to questions about movements that continued after the suspension. Mercado Bitcoin has not yet named an attack method, and the attack has not been attributed to any known group.
A payment halt is the usual first step in such cases. The exchange freezes all outflows so that an attacker cannot pull out further funds through a gap that is still open. For customers, this means that balances still appear in their accounts but cannot be transferred either to a wallet of their own or to a bank account until the exchange releases payments again.
The figure of more than $46 million comes from Cointelegraph's reporting and from security firms' analysis of blockchain data. Mercado Bitcoin itself has not confirmed a loss figure. According to Cointelegraph, the position late on Monday afternoon was as follows: stablecoin issuers Tether and Circle had frozen around $6.2 million. About $20 million had been forwarded to newly created wallets. More than $20 million still sat on addresses that Mercado Bitcoin has attributed to the incident, including all 106 Bitcoin moved in connection with the attack.
One point matters for putting this in context: it has not been publicly established whether the funds came from the exchange's reserves or from addresses that receive customer deposits. The exchange's statement that customers have not been harmed is therefore above all a promise to cover the loss itself. Whether and how quickly it can do so depends on the company's capital base, about which it has given no information in connection with this incident.
A first reconstruction came from Dickson Wu, senior security engineer at the auditing firm CertiK. According to his account, quoted by Cointelegraph, the attackers first worked their way across eight smaller blockchains over four hours, including Base, Optimism and Arbitrum. They then went after the exchange's central hot wallets. According to security firms, the attack ran through ordinary transfers rather than a vulnerability in a smart contract.
A hot wallet is a wallet whose keys sit on a system connected to the internet, so that withdrawals can be processed within minutes without manual approval. That is exactly why it is the preferred target: whoever controls the keys, or the system that signs transactions, can trigger transfers that look entirely regular to the blockchain.
One detail from the CertiK analysis carries particular weight. After the hot wallets were accessed, tiny amounts were transferred from 27,160 different addresses to a single address. Wu concludes from this that whoever is behind the attack can apparently also move money out of customers' deposit addresses. An exchange assigns such deposit addresses to each customer individually and afterwards sweeps the incoming amounts into its own wallets.
According to Cointelegraph, movements from addresses linked to the incident continued for hours after Mercado Bitcoin had announced the suspension of deposits and withdrawals. That is at odds with the picture of a quickly contained incident, but on its own it does not prove any loss for individual customers. Whether customer data has been affected is also unclear. If there were a data leak, the report says, this could trigger a duty to notify Brazil's data protection authority.
As long as an exchange suspends payments, customers cannot reach their balances, even if the account balance looks unchanged.
The fact that part of the haul was blocked within a few hours is down to the design of the large stablecoins. Tether and Circle can freeze their stablecoin tokens on individual addresses. Frozen tokens can no longer be transferred and therefore cannot be swapped into other assets on a decentralised exchange either. In this incident, according to Cointelegraph, that added up to around $6.2 million.
Bitcoin and most other cryptocurrencies have no such freeze function. There, the only option is to trace the stolen funds along their routes and hope that centralised exchanges halt incoming amounts from flagged addresses. For the Mercado Bitcoin case this means the exchange may be able to recover the frozen portion, while the outlook for the rest is far less certain.
The attack comes in an already tense week. The previous Thursday, Binance had reported an attack on its hot wallets in which, according to Cointelegraph, crypto assets worth $6.3 billion were drained. Binance suspended deposits and withdrawals, pledged to cover customers' losses and on Sunday began gradually reopening withdrawals. According to the exchange, 95 percent of the stolen assets had been replenished by then.
Mercado Bitcoin is many times smaller. According to Cointelegraph, the exchange counted 4.5 million users in July, when Tether announced a $20 million stake to support its expansion into tokenisation, payments and lending. Another Tether-backed trading venue in Latin America, Orionx of Chile, announced in September that it would close after a forensic review found that more than $7 million in customer assets had ended up in wallets outside its control.
Two cases are not enough to establish a pattern, and the causes have not been conclusively resolved at either exchange. What they share, though, is the sequence from the customer's point of view: access to your own balance ends abruptly, and when it returns is decided by the exchange alone.
What happened: On November 2, 2026, Mercado Bitcoin confirmed a cyberattack and halted all deposits and withdrawals. According to Cointelegraph, more than $46 million flowed out of the exchange's wallets, of which around $6.2 million has been frozen (as of late Monday afternoon). The exchange says customers have not been harmed.
Are you affected? Those directly affected are customers with balances at Mercado Bitcoin, whose withdrawals are on hold until they are released. If you have no account there, the halt does not touch you. It is still unclear whether customer data or deposit addresses have been compromised; until the exchange clarifies this, treat any message in its name as suspicious.
Our guide how to store crypto safely explains the basics of secure custody, and the hardware wallet comparison sets out the right devices.
Whatever is not being traded sits in a wallet of your own and is unaffected by an exchange's withdrawal halt.
Every exchange faces the same trade-off. Withdrawals are supposed to go through in minutes, so part of the holdings has to sit in hot wallets. The larger part is supposed to be protected against attacks, so it sits in a cold wallet. A cold wallet is a wallet whose keys are stored on devices without an internet connection, often spread across several people and locations. Transfers from there require several approvals and take correspondingly longer.
Most exchanges do not disclose in detail how their holdings are split. An attack on the hot wallets therefore usually hits only part of customer funds, but, as the Binance and Mercado Bitcoin cases show, it can still reach sums in the tens of millions or even billions of dollars. What matters for customers then is whether the exchange has enough capital of its own or reserves to close the gap.
As a retail investor, you have no say over this split. What you can control is how much of your holdings sits on an exchange at all. A hardware wallet keeps the keys on a dedicated device, a software wallet on your smartphone or computer. In both cases, access no longer depends on whether an exchange happens to be processing withdrawals.
In the EU, the Markets in Crypto-Assets Regulation, MiCA for short, sets out the obligations that providers of crypto services must meet. These include requirements on separating customer funds from the firm's own assets, on custody and on handling security incidents. An exchange that serves customers in an EU country such as Germany needs authorisation as a crypto-asset service provider. Whether a provider holds one is shown in the public register of the European Securities and Markets Authority, ESMA.
A licence does not prevent a hack. It does, however, ensure that a supervisor looks at how customer funds are segregated and held, and that there is someone to turn to when something goes wrong. Which platforms are authorised and how they differ on fees and custody is shown in our overview of regulated crypto exchanges.
Mercado Bitcoin targets the Brazilian market and is subject to supervision there. How the exchange deals with the incident, whether it confirms a loss figure and when withdrawals will be possible again remained open at the time of writing.
All told, the case remains a problem for Brazilian customers for now. For everyone else, it is the second reminder within a few days of how the split between exchange and wallet should look:
(As of November 2, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
