hack or exploit

Mercado Bitcoin freezes deposits and withdrawals after security incident

81Importance
updatingStatus
21News media
43Pieces
Published
Updated
Since then
42 new reports
Also mentions
BTCETHUSDT +10

Mercado Bitcoin suspended deposits and withdrawals after reporting a security incident on November 2, and outside estimates of the amount moved or stolen ranged from about $38 million to $49 million across multiple blockchains. The exchange, Tether, and Chainalysis later said parts of the funds had been frozen or blocked, while subsequent onchain tracking showed attackers moving some assets after the breach was first said to be contained.

Key claims & sources

✓
Mercado Bitcoin said it detected a security incident in one of its systems on November 2 and then suspended deposits and withdrawals.
✓
Tether froze more than 4.5 million USDT linked to the incident after blacklisting wallets identified by the exchange.
✓
Arkham grouped the suspected attacker activity into 36 addresses and valued the holdings at $46 million.
✓
Hypernative estimated that more than $40 million left wallets tied to Mercado Bitcoin, and the transfers touched at least 10 blockchains.
✓
Chainalysis said it helped freeze nearly $10 million in stolen funds after Mercado Bitcoin reported the November 2 incident.
✓
Mercado Bitcoin said about $38 million was involved and that it had already blocked $11 million with help from Tether, Circle, Paxos, BRL1 and Chainalysis.
✓
Mercado Bitcoin later said it would use company funds to replace affected assets and planned a view-only reopening on November 9, while withdrawals and trading were still awaiting security clearance.

What it means

Mercado Bitcoin, Brazil's oldest and largest crypto exchange, dates to 2013 and has weathered earlier regulatory scrutiny from the country's securities body. The November 2 freeze lands days after the record $6 billion Binance hack, putting a second major platform's custody practices under scrutiny inside the same week. Brazilian users had few local alternatives of comparable scale, which makes the exchange's security posture a national, not just corporate, concern.

Customers cannot move funds in or out while Mercado Bitcoin investigates, and the exchange has named destination wallets receiving bitcoin, ether and other assets without disclosing a total loss figure. Tether's freeze of over 4.5 million USDT tied to the incident shows stablecoin issuers acting as a backstop, blocking some proceeds on Ethereum and Tron even as the exchange insists customers themselves suffered no losses.

An attacker still holding $46 million across 36 tracked addresses, per Arkham, shows how quickly stolen funds fragment across chains faster than exchanges can react. Tether's ability to blacklist wallets on demand is useful for containment, but it also exposes how centralized the 'decentralized' rails really are: one issuer's compliance call, not code, decided which funds moved and which froze.

Whether Mercado Bitcoin discloses a final loss figure and a timeline for restoring withdrawals will determine how much of the $40 to $46 million estimated by Hypernative and Arkham gets clawed back. Further Tether freezes, or their absence, will signal how much of the attacker's remaining balance is still reachable before it exits through less cooperative venues.

Market reaction i

BitcoinBTC it is the asset of the company or protocol in the event
first headline
0.0% 2 h before
-1.1% 4 h after
$77,925price at publication
11data points

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Nov 2 13:58
+16 min
Nov 2 14:15
crypto.news context
Its angle: identifying; with quotes
+52 min
Nov 2 14:50
The Defiant context
Its angle: identifies, receiving, ether; with quotes
+1 h 18 m
Nov 2 15:17
+1 h 19 m
Nov 2 15:17
The Defiant echo
No new facts: blacklist, actions, against
+1 h 34 m
Nov 2 15:32
Unchained echo
No new facts: received, minutes, wrote; with quotes
+1 h 55 m
Nov 2 15:53
CoinDesk echo
Picks up what was published, with no new facts
+1 h 59 m
Nov 2 15:57
+2 h 10 m
Nov 2 16:09
Bitcoin Magazine echo
No new facts: identification, bloomberg, timetable; with quotes
+2 h 14 m
Nov 2 16:12
+2 h 16 m
Nov 2 16:14
The Defiant adds
Adds $46M, with quotes
+2 h 41 m
Nov 2 16:39
Crypto Economy echo
No new facts: pablosabbatella, architecture, established; with quotes
+2 h 47 m
Nov 2 16:46
Decrypt echo
Picks up what was published, with no new facts
+2 h 52 m
Nov 2 16:50
Protos adds
Adds $1.5B, with quotes
+3 h 8 m
Nov 2 17:07
+3 h 35 m
Nov 2 17:33
U.Today echo
No new facts: confirming, partner, ripple
+4 h 3 m
Nov 2 18:01
CP CryptoPotato echo
No new facts: authorized, transfer, created; with quotes
+4 h 3 m
Nov 2 18:02
DefiLlama hacks echo our clock
No new facts: technique, avalanche, arbitrum
+5 h 7 m
Nov 2 19:05
Cointelegraph echo
No new facts: computer, coins, flow
+5 h 37 m
Nov 2 19:35
The Defiant adds
Brings into the story: ETH
+6 h 21 m
Nov 2 20:19
The Block echo
Picks up what was published, with no new facts
+7 h 32 m
Nov 2 21:30
CR Cryptopolitan echo
No new facts: intrusion, bringing, analysts; with quotes
+9 h 59 m
Nov 2 23:57
Blockchain.News adds
Adds $10M, with quotes
+10 h 57 m
Nov 3 00:56
The Defiant adds
Adds $49M and $11M, with quotes
+14 h 4 m
Nov 3 04:03
+16 h 45 m
Nov 3 06:43
Crypto News Australia adds
Breaks the figures down; the largest, $65.8M, with quotes
+17 h 15 m
Nov 3 07:14
+18 h 58 m
Nov 3 08:56
+19 h 10 m
Nov 3 09:08
The Defiant echo
No new facts: assurance, deadline, funding; with quotes
+20 h 17 m
Nov 3 10:15
Unchained echo
No new facts: translation, suspending, protocols; with quotes
+21 h 40 m
Nov 3 11:39
Crypto Economy echo
No new facts: investigations, compromised, financially; with quotes
+23 h 2 m
Nov 3 13:00
+23 h 10 m
Nov 3 13:09
The Cryptocurrency Post echo
No new facts: investigates, operational, coordinates; with quotes
+23 h 45 m
Nov 3 13:43
The Crypto Guardian echo
No new facts: identificamos, intelligence, unauthorized; with quotes
+1 d 1 h
Nov 3 15:30
The Daily Hodl adds
Sharpens the figure: $46.3M, with quotes
+1 d 8 h
Nov 3 22:35
CP CryptoPotato echo
No new facts: coordination, continuing, previously; with quotes
+1 d 14 h
Nov 4 04:00
NewsBTC echo
No new facts: establishes, reconstruct, credibility; with quotes
+1 d 23 h
Nov 4 13:53
Crypto Briefing echo
No new facts: vulnerabilities, emphasizing, recovering
+1 d 23 h
Nov 4 13:57
+2 d 9 h
Nov 4 23:36
The Defiant echo
No new facts: reopening, clearance, replace; with quotes
+2 d 20 h
Nov 5 10:44
CoinDesk echo
Picks up what was published, with no new facts
+2 d 22 h
Nov 5 12:27
Crypto Economy adds
Sharpens the figure: $48.6M, with quotes
+3 d 6 h
Nov 5 20:16
Decrypt echo
No new facts: different, forensic, stopped; with quotes

Thefts of a similar size

WhenWhat happenedFigure
2 months ago Nesa · Arithmetic Error incident $50M
1.7 years ago Infini · Lack of strict access control incident $50M
2.1 years ago Radiant V2 · Blind Signing incident $50M
1.7 years ago Infini · Private Key Compromised incident $49.5M
1.2 years ago BtcTurk · Hot Wallet Key Compromised incident $48M

4280 incidents stored · 130 were as large as this one or larger ($49M)