Mercado Bitcoin Says Customers Won't Lose Funds After Hackers Drain Its Hot Wallets; $11 Million Frozen

Brazilian cryptocurrency exchange Mercado Bitcoin said customers will not lose any assets after an attacker drained funds from its online "hot" wallets early on Monday, November 2, 2026. The exchange took its platform offline as a precaution and, as of its latest update, had not said when it would reopen.

In an update posted to its help center at 9 p.m. Brasília time on Monday (7 p.m. ET), the exchange said that about $11 million had been blocked with help from the crypto community, token issuers and recovery specialists including Tether, Circle, BRL1, Paxos and Chainalysis. It said about $38 million had not yet been blocked, and that it had identified other amounts that could potentially be frozen.

What happened

The exchange said it detected the incident in the early hours of Monday, activated its governance protocols, notified authorities and took the platform down. It explained that only a small portion of customer assets is held in hot wallets used for day-to-day deposits and withdrawals, while most are kept in offline "cold" wallets. The incident affected only the hot wallets, it said.

Blockchain analytics firm Chainalysis, which said Mercado Bitcoin is one of its customers, said the attacker moved assets held across 17 blockchains "in waves," draining an estimated $49 million in various cryptocurrencies. The largest amounts came from Bitcoin and Ethereum, with assets on smaller networks such as Base, Tron and Polygon also taken. Chainalysis said a Mercado Bitcoin director called its team at 2:30 a.m. ET to report the hack.

CoinDesk reported, citing a report relayed by Pablo Sabbatella, founder of security firm Opsek, that the largest outflows came between 06:19 and 06:53 UTC. According to that report, the transfers were ordinary signed transactions rather than a smart contract exploit, and the attacker held roughly 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and 77,000 AVAX, along with more than 200 other tokens. How the attacker obtained signing access has not been disclosed.

Estimates of the total have varied. The Block put the breach at about $46.3 million, citing Arkham data, and CoinDesk said security firms initially estimated more than $40 million. The exchange's own figures of about $11 million blocked and $38 million not yet blocked add up to about $49 million.

Freezes and tracing

Chainalysis said its investigators contacted law enforcement within 30 minutes of the call to share addresses where funds could be frozen, and worked with stablecoin issuers including Paxos, Anchorage Digital, Ripple, Circle and Tether. It said Tether froze more than $9 million of stolen funds. Mercado Bitcoin also published the destination addresses on several networks so others could track the funds, CoinDesk reported.

No one has been publicly blamed. CoinDesk reported that there is no public evidence linking the incident to last week's hack of Binance, which the FBI attributed to North Korea's TraderTraitor group. The exchange said in a statement reported by CoinDesk that no customer data had leaked.

Mercado Bitcoin also warned customers about scams, saying it never asks for passwords, verification codes or recovery phrases and does not offer refunds through links, WhatsApp or phone calls.

Market backdrop

The breach is one of several security incidents to hit the crypto industry since the $6.3 billion Binance hack disclosed last week. Binance customers have withdrawn a net $4.72 billion since the exchange reopened withdrawals on Sunday, CoinDesk reported on Tuesday.

U.S. spot bitcoin exchange-traded funds had $399 million of net outflows on Monday, their second straight day of withdrawals, according to Farside Investors data cited by CoinDesk. BlackRock's iShares Bitcoin Trust (IBIT) lost $405 million, its largest daily outflow since June.

Bitcoin traded at about $76,967 at 7:12 a.m. ET on Tuesday, according to Yahoo Finance data, after dipping to around $76,300 during the European morning, CoinDesk reported. CoinDesk said implied volatility on the nearest-dated bitcoin options had risen to about 51% from about 43.5% the day before as U.S. voters headed to the polls in the midterm elections. CoinMarketCap's fear and greed index slipped to 34 out of 100, in the "fear" zone, CoinDesk reported.