Mercado Bitcoin hack 2026: deposits and withdrawals paused after about $46 million left its wallets
Fact-checked against primary sources by the CryptoGuardz Register Desk · Editorial policy
Mercado Bitcoin hack: withdrawals paused after drain
Brazilian exchange Mercado Bitcoin paused deposits and withdrawals on 2 November 2026 after hot wallets were drained across at least ten blockchains, with analytics firms estimating losses of $46 million to $49 million. The exchange promises on X that customers will lose no assets, but has not said how it will cover the loss or when it will reopen.
Piece published Reviewed by CryptoGuardz Register Desk, editorial desk
Brazilian exchange Mercado Bitcoin paused deposits and withdrawals on 2 November 2026 after its hot wallets were drained across at least ten blockchains. Arkham put the loss at at least $46 million, Bitquery at about $48.5 million and Chainalysis at about $49 million. The exchange says customers suffered no losses. By 3 November it had not given a date for reopening.
Mercado Bitcoin is not on the exchange register. The incident is here because it is the second custodial exchange in four days to stop withdrawals after a hot-wallet theft, after the Binance hack.
What the document says
The exchange's first statement, posted on X in Portuguese on the morning of 2 November:
Identificamos e contivemos com rapidez um incidente de segurança em um de nossos sistemas nesta madrugada.
In English: it identified and quickly contained a security incident in one of its systems overnight. The same post says there was no harm to customers and no data leak, and that deposits and withdrawals were paused as a precaution.
According to Arkham, the draining began on Base at 01:22 UTC, opening with a 0.0001 ETH test transaction. At 06:24 UTC, 2,852 ETH left a Mercado Bitcoin hot wallet, followed within two minutes by USDT and USDC, and at 06:41 UTC 104.43 BTC was swept from the Bitcoin hot wallet. How the attacker got signing access has not been disclosed.
Where the money went
The first Ethereum address Arkham ties to the attacker, 0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478, was read on Blockscout on 3 November. On 2 November it sent out five large transfers: 2,800 ETH at 12:07 UTC, then 200, 470, 130 and 50 ETH, 3,650 ETH in all. That is more than the 2,852 ETH taken from the hot wallet, which fits the 287 token swaps Arkham counted from the hacker's wallets. When read, the address held less than 1 ETH, and its history was full of zero-value transfers from lookalike addresses, the address-poisoning pattern.
Freezes so far:
| Who | What | Per |
|---|---|---|
| Tether | more than 4.5 million USDT, by 15:07 UTC on 2 November | Tether CEO on X |
| Tether and Paxos | about $7.3 million combined, by 15:46 UTC | Bitquery |
| All parties | nearly $10 million | Chainalysis |
| Mercado Bitcoin's own count | US$11.2 million blocked, with issuers' help | reported by Times Brasil |
Bitquery found that Circle had frozen nothing by its cut-off, leaving about $4.29 million in USDC and EURC free to move.
What it changes for users
Customers cannot deposit or withdraw until the exchange reopens, and no date has been given. Bitquery counted 35,853 Ethereum deposit addresses whose balances were moved, about $261,000 in total between 12:10 and 15:44 UTC. Bitquery says about 91% of a sample held under $10, and an address count is not a customer count.
The promise is the exchange's, made on X in a second post that evening: it says customers will have no loss of assets. It has not said how the loss will be covered. A balance on a custodial exchange is a claim on the operator, as the Binance freezes showed.
Quick answers
How much was stolen from Mercado Bitcoin?
Estimates run from at least $46 million (Arkham) to about $49 million (Chainalysis). The exchange has not given a figure for how much was stolen; per Times Brasil it put the assets involved at about US$49 million.
Can Mercado Bitcoin customers withdraw?
Not as of 3 November 2026. Deposits and withdrawals were paused on 2 November and no reopening date has been announced.
Was any of the money frozen?
Yes. Chainalysis counted nearly $10 million frozen, led by Tether. Mercado Bitcoin reportedly put its own figure at US$11.2 million.
Sources
- Mercado Bitcoin on X, official statement, 2 November 2026, retrieved 3 November 2026
- Mercado Bitcoin on X, update promising no loss of assets, 2 November 2026, retrieved 3 November 2026
- Paolo Ardoino (Tether) on X, USDT freeze, 2 November 2026, retrieved 3 November 2026
- Arkham Research, Mercado Bitcoin hack trace, 2 November 2026, retrieved 3 November 2026
- Chainalysis, response to the Mercado Bitcoin hack, 2 November 2026, retrieved 3 November 2026
- Bitquery, Mercado Bitcoin hack investigation, data to 15:46 UTC on 2 November 2026, retrieved 3 November 2026
- Blockscout, Ethereum address 0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478, read 3 November 2026
- Blockscout, outbound transaction of 2,800 ETH, 2 November 2026, retrieved 3 November 2026
- Times Brasil, Mercado Bitcoin says it blocked US$11.2 million, 2 November 2026, retrieved 3 November 2026
- CoinDesk, Mercado Bitcoin halts withdrawals after drain across 10 chains, 2 November 2026, retrieved 3 November 2026
About this piece
Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.