hack or exploit

Mercado Bitcoin freezes deposits and withdrawals after security incident

82Importance
updatingStatus
12News media
19Pieces
Published
Updated
Since then
18 new reports
Also mentions
BTCETHUSDT +8

Mercado Bitcoin suspended deposits and withdrawals after a security incident and remained under investigation as outside trackers and the exchange itself described large outflows from wallets tied to the Brazilian platform. New reporting added chain-specific details, including a Stellar address holding 6.7 million XLM and a broader cross-chain estimate of the affected funds.

Key claims & sources

✓
DefiLlama recorded the exploit as a $40.0 million event and listed activity across Bitcoin, Ethereum, Solana, TRON, Polygon, Arbitrum, Avalanche, BSC, Stellar, and XDC.
✓
Mercado Bitcoin halted deposits and withdrawals after identifying a security incident in one of its systems on November 2.
✓
Hypernative estimated that more than $40 million left wallets tied to Mercado Bitcoin, while the tracker said the transfers moved across multiple blockchains.
✓
Tether froze more than 4.5 million USDT linked to the Mercado Bitcoin incident.
✓
Mercado Bitcoin disclosed an on-chain address holding 6.7 million Stellar (XLM) after the breach.
✓
Arkham grouped the attacker’s activity into 36 addresses and put the holdings at $46 million.
✓
The exchange said it detected the incident early Monday morning and then moved to suspend deposits and withdrawals.

What it means

Mercado Bitcoin, Brazil's oldest and largest crypto exchange, dates to 2013 and has weathered earlier regulatory scrutiny from the country's securities body. The November 2 freeze lands days after the record $6 billion Binance hack, putting a second major platform's custody practices under scrutiny inside the same week. Brazilian users had few local alternatives of comparable scale, which makes the exchange's security posture a national, not just corporate, concern.

Customers cannot move funds in or out while Mercado Bitcoin investigates, and the exchange has named destination wallets receiving bitcoin, ether and other assets without disclosing a total loss figure. Tether's freeze of over 4.5 million USDT tied to the incident shows stablecoin issuers acting as a backstop, blocking some proceeds on Ethereum and Tron even as the exchange insists customers themselves suffered no losses.

An attacker still holding $46 million across 36 tracked addresses, per Arkham, shows how quickly stolen funds fragment across chains faster than exchanges can react. Tether's ability to blacklist wallets on demand is useful for containment, but it also exposes how centralized the 'decentralized' rails really are: one issuer's compliance call, not code, decided which funds moved and which froze.

Whether Mercado Bitcoin discloses a final loss figure and a timeline for restoring withdrawals will determine how much of the $40 to $46 million estimated by Hypernative and Arkham gets clawed back. Further Tether freezes, or their absence, will signal how much of the attacker's remaining balance is still reachable before it exits through less cooperative venues.

Market reaction i

BitcoinBTC it is the asset of the company or protocol in the event
first headline
0.0% 2 h before
-1.1% 4 h after
$77,925price at publication
11data points

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Nov 2 13:58
+16 min
Nov 2 14:15
crypto.news context
Its angle: identifying, detected; with quotes
+52 min
Nov 2 14:50
The Defiant context
Its angle: identifies, disclosure, receiving; with quotes
+1 h 18 m
Nov 2 15:17
+1 h 19 m
Nov 2 15:17
The Defiant echo
No new facts: blacklist, against, actions
+1 h 34 m
Nov 2 15:32
Unchained echo
No new facts: attributes, newsletter, unchained; with quotes
+1 h 55 m
Nov 2 15:53
CoinDesk echo
Picks up what was published, with no new facts
+1 h 59 m
Nov 2 15:57
+2 h 14 m
Nov 2 16:12
+2 h 16 m
Nov 2 16:14
The Defiant adds
Adds $46M, with quotes
+2 h 41 m
Nov 2 16:39
Crypto Economy echo
No new facts: pablosabbatella, architecture, established; with quotes
+2 h 47 m
Nov 2 16:46
+2 h 52 m
Nov 2 16:50
Protos adds
Adds $1.5B, with quotes
+3 h 8 m
Nov 2 17:07
+3 h 35 m
Nov 2 17:33
U.Today echo
No new facts: confirming, reporting, partner
+4 h 3 m
Nov 2 18:01
CP CryptoPotato echo
No new facts: preliminary, authorized, including; with quotes
+4 h 3 m
Nov 2 18:02
DefiLlama hacks echo our clock
No new facts: technique, avalanche, arbitrum
+5 h 7 m
Nov 2 19:05
Cointelegraph echo
No new facts: computer, moving, coins
+5 h 37 m
Nov 2 19:35
The Defiant adds
Brings into the story: ETH

Thefts of a similar size

WhenWhat happenedFigure
5.5 years ago EasyFi · Private key leakage incident $46.9M
2.1 years ago BingX · Hot wallet key compromised incident $45M
3.5 years ago CoinDeal · Scam incident $45M
5.5 years ago Bunny · Spot Price Manipulation incident $45M
6.7 years ago Josh Jones incident $45M

4268 incidents stored · 133 were as large as this one or larger ($46M)