Mercado Bitcoin hot wallet stolen for approximately $49 million, with approximately $11 million frozen.
In an official update at 21:00 Brasilia Time on November 2, 2026 (08:00 Beijing Time on November 3), Brazilian crypto exchange Mercado Bitcoin confirmed that the early morning security incident only impacted the hot wallet, with approximately $11 million already frozen and about $38 million remaining unfrozen; deposits and withdrawals were suspended following the incident, with no set timeline for resumption.
Assets on 17 Chains Were Transferred Out in Batches
On-chain analytics firm Chainalysis stated in a blog post that Mercado Bitcoin is Brazil's largest crypto exchange. Attackers began transferring assets across 17 blockchains in batches early on November 2, with an estimated theft of approximately $49 million. The majority came from Bitcoin and Ethereum, also involving Base, Tron, and Polygon. According to TechFlow's calculations, the sum of the frozen and unfrozen amounts announced by the exchange totals roughly $49 million, aligning with Chainalysis's estimate.
Chainalysis recorded that at 2:30 AM Eastern Time on November 2 (3:30 PM Beijing Time), a director at Mercado Bitcoin called for assistance, prompting Chainalysis to contact law enforcement within 30 minutes. In a security bulletin released at 11:56 (Brasilia Time) that day, the exchange disclosed five receiving addresses covering the EVM, BTC, Solana, Stellar, and Tron networks. The EVM address is 0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478.
The Estimated Stolen and Frozen Amounts Increased Over Time
SourceEstimated StolenFrozen Amount
Hypernative (via Decrypt)Over $40 million, on at least 10 chainsTether froze over 4.5 million USDT
Security Firm (via The Record)Over $46 millionUndisclosed
ChainalysisApproximately $49 million, across 17 chainsNear $10 million, including over $9 million frozen by Tether
Mercado Bitcoin 21:00 UpdateApproximately $49 millionApproximately $11 million
According to Decrypt, security firm Hypernative was the first to detect the outflow of funds, with Tether CEO Paolo Ardoino stating at the time that over 4.5 million USDT had been frozen. By the 21:00 update, the exchange listed collaborating partners including Tether, Circle, BRL1, Paxos, and Chainalysis, noting that additional funds eligible for freezing had been identified.
Based on TechFlow's calculations, the currently frozen portion accounts for approximately 22% of the total stolen amount. Of the nearly $10 million in frozen funds tracked by Chainalysis, over $9 million was frozen by Tether. In this incident, the amount recoverable largely depends on the freeze capabilities held by stablecoin issuers.
"No Customer Losses" Claim Challenged
In its initial notice at 9:56 (Brasilia Time, 20:56 Beijing Time on November 2), Mercado Bitcoin stated that the incident was quickly contained, customers suffered no losses, and no data breach occurred, framing the suspension of deposits and withdrawals as a precautionary measure. The 21:00 update revised this to guarantee that customers would not lose assets due to the incident, adding that most assets are stored in cold wallets. According to The Record, some experts have questioned the "no customer losses" claim based on on-chain data.
This incident occurred three days after Binance's hot wallet was hacked for approximately $6.3 billion, an event that took place in the early hours of October 30 Beijing Time. Mercado Bitcoin stated that deposits and withdrawals will only resume once the platform confirms security, with the restoration timeline to be announced in future updates; as of 16:00 Beijing Time on November 3, the help center still only featured these three updates, with no specific dates provided.