hack or exploit

Brazil’s Largest Crypto Exchange Hit by Cyberattack as Losses Top $45M

47Importance
closedStatus
3News media
3Pieces
Published
Updated
Since then
2 new reports
Also mentions
BTC

Mercado Bitcoin said customers will not be left with the bill for the hack that drained tens of millions from the exchange, and withdrawals remain frozen with no restart date. Brazil’s largest digital asset exchange was also described as having lost more than $45 million in a cyberattack, alongside a broader run of crypto hacks over 30 days. Kraken reported delays in Brazilian real deposits and withdrawals through PIX on November 3.

Key claims & sources

✓
Brazil’s largest digital asset exchange, Mercado, was hit by a cyberattack that drained more than $45 million.
✓
The attack was described as one of several crypto hacks seen over a 30-day period.
✓
Mercado Bitcoin said customers will not bear the loss from the hack that drained tens of millions from the exchange.
✓
Withdrawals on Mercado Bitcoin are still frozen, and the company has not given a date for when they will resume.
✓
Kraken said on November 3 that it was investigating delays in Brazilian real deposits and withdrawals through PIX, with some transfers pending longer than usual.

What it means

Mercado Bitcoin has operated since 2013 and built its position as Brazil's largest exchange partly on trust in custodial safekeeping, the same promise every centralized platform makes after FTX. PIX, the Central Bank's instant payment rail, is the backbone Brazilians use to fund crypto accounts, which is why a rail problem at Kraken lands the same week as a drained hot wallet at Mercado. The $45 million loss joins a run of breaches logged over the past month.

Mercado Bitcoin's customers cannot withdraw funds and have no published date for when that changes, leaving deposits effectively locked regardless of the refund pledge. Traders who hold balances on the platform must wait on the company's own timeline rather than move assets elsewhere. Kraken users sending or receiving reais through PIX face separate, unrelated delays, meaning Brazilian crypto users are contending with friction on two major platforms at once, through no fault of their own trading decisions. (per decrypt.co)

A pledge to make customers whole after a $40 million-plus breach is reassuring, but it also underlines how much ordinary users depend on an exchange's balance sheet and goodwill rather than on-chain guarantees. Crypto's original pitch was removing that kind of counterparty trust; a hot wallet breach followed by a corporate promise to cover losses is the opposite of self-custody, even when the company keeps its word. Repeated incidents like this one erode confidence in custodial platforms generally, not just the one breached.

Mercado Bitcoin has not set a date for restarting withdrawals, so the next concrete marker is whenever the exchange issues that restart notice or details how the refund will be funded and distributed. Kraken logged its PIX investigation on November 3 and has not confirmed a resolution time with its payment provider. Either announcement, or continued silence past these points, will show whether both companies can match their public assurances with actual execution.

Market reaction i

BitcoinBTC market event: it is read against the reference
first headline
+0.5% 2 h before
+0.1% 4 h after
$77,581price at publication
11data points

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Nov 3 16:28
+1 h 47 m
Nov 3 18:16
Decrypt context
Its angle: millions, restart, biggest; with quotes
+4 h 11 m
Nov 3 20:39
Kraken status adds
Brings into the story: PIX

Thefts of a similar size

WhenWhat happenedFigure
2.1 years ago BingX · Hot wallet key compromised incident $45M
3.5 years ago CoinDeal · Scam incident $45M
5.5 years ago Bunny · Spot Price Manipulation incident $45M
6.7 years ago Josh Jones incident $45M
7.6 years ago CoinBene · Improper access control incident $45M

4280 incidents stored · 140 were as large as this one or larger ($45M)