One of Brazil’s largest cryptocurrency exchanges, Mercado Bitcoin, suspended deposits and withdrawals on November 2, 2026, after detecting what it described as a security incident affecting one of its internal systems. The timing lines up closely with findings from blockchain security firm Hypernative, which flagged more than $40 million in suspicious outbound transfers spread across at least ten different blockchain networks — a figure the exchange itself has not confirmed as its actual loss.

In a statement posted to its official account, Mercado Bitcoin said it had contained the incident quickly in the early hours of Monday morning, and emphasized that customers were not harmed and that no customer data had leaked. The company described the trading suspension as a precautionary measure taken while its teams investigate the incident, trace the movement of affected assets, and coordinate with law enforcement.

A Narrow, Fast-Moving Window of Activity

According to findings shared by Opsek founder Pablo Sabbatella, researchers traced transfers moving from wallets linked to Mercado Bitcoin into freshly created addresses across a wide span of networks, including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain, and Stellar. The bulk of the reported outflows occurred in a tight 34-minute window between 06:19 and 06:53 UTC, though some Bitcoin movements reportedly began earlier, around 02:15 UTC, as funds shifted from deposit addresses toward wallets linked to the suspected attacker.

Preliminary estimates compiled by researchers — again, not figures Mercado Bitcoin has publicly verified — put the affected holdings at roughly:

• 2,852 ETH
• 106 BTC
• 10,700 SOL
• 6.7 million XLM
• More than 200 additional tokens across the affected chains

Ordinary Transfers, Not a Smart Contract Exploit

One detail investigators consider significant is that the suspicious movements appear to be straightforward, validly signed transactions rather than the product of a smart contract vulnerability being exploited. That distinction shifts the central question away from “was a contract hacked” and toward a more uncomfortable one for any exchange: how did an attacker obtain valid transaction-signing access in the first place? Public reporting hasn’t yet established which internal system was compromised or how the attacker acquired that signing capability, whether through compromised credentials, an insider pathway, infrastructure access, or some other route.

This incident follows a string of other exchange-related wallet breaches that have drawn comparisons from researchers, including the earlier Bitget hot wallet hack, which similarly involved unauthorized transfers out of hot and warm wallet infrastructure. Reporting is careful to note that this comparison is offered only as industry context — nothing currently ties the Mercado Bitcoin incident to the same attacker or method.

Publishing Destination Addresses for Tracing

In the aftermath, Mercado Bitcoin published a list of destination wallet addresses spanning Ethereum-compatible chains, Bitcoin, Solana, Stellar, and Tron, saying the goal was to help the broader community identify and track the funds across public blockchains. This kind of transparent on-chain tracing has helped investigators in past incidents, most notably the long-running Bitfinex hack investigation, where publicly visible blockchain movement eventually helped tie stolen funds to specific laundering activity years after the original theft.

What’s Still Unknown

As of this report, Mercado Bitcoin has not announced when trading will resume, nor has it specified exactly which internal system was compromised. The central tension in the company’s own messaging is worth noting directly: its assurance that customers were not harmed describes the user-facing impact, not necessarily whether exchange-held assets were taken. Those are two different claims, and only the second one determines how large this loss ultimately turns out to be.

For Mercado Bitcoin users, the practical advice echoes what’s typically recommended after any exchange security incident: watch official channels for updates rather than third-party claims, avoid acting on unsolicited messages referencing the incident, and treat any request to “verify” an account or re-enter credentials in response to the breach with suspicion until the exchange’s own support channels confirm it’s legitimate.