Mercado Bitcoin: Brazil's Biggest Crypto Exchange Lost About $46M, Trackers Say
Mercado Bitcoin froze withdrawals on 2 November after trackers counted $46M leaving. The exchange says its customers lose nothing. It has not named a final figure.
Key numbers
$46M+
Stolen (Arkham count)
About $38M
Exchange's own estimate
$15M+
Frozen so far (exchange)
Unidentified
Attacker
Brazil woke up on Monday 2 November 2026 to a frozen crypto exchange. Mercado Bitcoin, the country's largest, had stopped all deposits and withdrawals after what it called a security incident "early this morning". By then, blockchain trackers had already watched tens of millions of dollars leave its wallets in a little over half an hour.
Mercado Bitcoin describes itself as the largest digital assets investment platform in Latin America, with about 4.5 million customers, The Record reported. An exchange is a broker for digital coins: customers hand it money, it holds their coins and lets them trade or take them out. It is not a bank, and the coins it holds are only as safe as its own wallets.
How much, and who is counting
Mercado Bitcoin has not published a final loss figure, and the numbers depend on who is asked. Hypernative, a security firm, flagged more than $40 million of suspicious transfers across at least 10 blockchains, Decrypt reported. Tecnoblog, a Brazilian technology site, converted Hypernative's roughly $40 million into about R$217 million, which is where the "R$217 million" headline comes from.
Arkham Intelligence, a blockchain tracking firm, counted about $46.3 million, The Block reported. Chainalysis, a firm that traces stolen crypto, estimated about $49 million taken from 17 blockchains, ForkLog reported. Mercado Bitcoin itself has since put the amount involved at about $38 million, with about $11 million blocked, crypto.news reported. The exchange has not said whether that $38 million already excludes the frozen coins.
CMZ uses the Arkham figure of $46 million as the headline because it is the most widely cited independent count, and shows the others beside it. None of the numbers is an audited loss.
Thirty-four minutes on a Monday morning
Most of the transfers happened between 03:19 and 03:53 Brasilia time (06:19 to 06:53 UTC), Tecnoblog reported, citing Hypernative. The coins went to newly created addresses that Hypernative tied to a possible attacker.
The theft was not a flaw in clever code. Security firms said the attacker used ordinary transfers, Cointelegraph reported, not a bug in a smart contract (a program that moves money by itself). The targets were the exchange's hot wallets, the online wallets that work like a shop's cash drawer, kept ready for customer withdrawals. Cointelegraph also reported that funds were taken from customer deposit addresses, the individual receiving addresses an exchange gives each customer. Emmett Gallic, an Arkham analyst, said the attacker was pulling money from older deposit addresses and selling memecoins and other smaller coins.
Dickson Wu, of the security firm CertiK, said the attackers "picked at eight small chains for four hours", including Base, Optimism and Arbitrum, before moving on to the main hot wallets, Cointelegraph reported. He also said they sent tiny amounts of ether from 27,160 addresses. How the attacker got in has not been disclosed.
By 16:42 UTC that day, Tether and Circle had frozen about $6.2 million between them, Cointelegraph reported. Tether is the company behind USDT, a stablecoin, a coin pegged to the US dollar. Circle issues another, USDC. Both can lock coins held at a given address. Paolo Ardoino, Tether's chief executive, said Tether froze more than $4.5 million of USDT. Other platforms had frozen about $2 million more, The Record reported.
Funds safe? Experts disagree
The exchange said on social media that its teams had "identified and swiftly contained" the incident, and that it caused no harm to customers and no data leak. It published the addresses that received the stolen coins so others could watch them.
Several blockchain security experts disputed the claim that customer funds were untouched, The Record reported, citing on-chain evidence that money was taken from some customer wallets. The exchange's answer is that it will cover the losses itself, so customers end up whole either way. Bloomberg Linea, a Brazilian business outlet, reported the company said it would absorb a loss of $40 million. That promise cannot yet be checked from outside.
Is it back? Not yet
As of 5 November, withdrawals are still closed. Mercado Bitcoin told Cointelegraph that customers get account access back on Monday 9 November, first through the website, to see balances, statements and holdings. Transfers, withdrawals and trading follow in later phases, each one only after independent security testing. No dates have been given for those phases.
The exchange says it will use its own money to replace the lost coins. "Our trading desk is preparing to begin the necessary repurchases in domestic and international markets," it said. It also pointed to a $20 million investment from Tether, announced in July, for its cash position. The frozen total, by its own count, has risen from about $11 million to more than $15 million, with help from Tether, Circle, Paxos, BRL1 and Chainalysis.
BitMart: a smaller hit with the same address
The story took a second turn on 3 and 4 November. BitMart, a global exchange already winding down, confirmed its own breach. Sheldon Xia, its founder, said in a post on X that the amount was "small" and gave no figure. His early investigation, he said, suggests the same group that hit Mercado Bitcoin was behind it. He called this preliminary.
Bitquery, a blockchain analytics firm, put the BitMart outflows at about $391,000 from wallets mostly linked to BitMart across three blockchains. Bitquery traced them to attacker-controlled addresses also used against Mercado Bitcoin, and said they began about 53 minutes before the larger raid. Reports differ on the date, with some saying 2 November and others 3 November. A shared receiving address links the two thefts. It does not say who the attacker is or how either exchange was entered.
Xia also said BitMart's security team is "severely understaffed". BitMart announced in July that it would end trading and stop operating, and many customer withdrawals there remain unresolved. Its 2021 breach, which took about $196 million by PeckShield's count, is part of why it is in trouble.
What is not known
Nobody has been named. Binance lost about $6.3 billion days earlier, and the FBI blamed North Korea's TraderTraitor group for that theft, The Record and Decrypt reported. No public evidence links the Mercado Bitcoin theft to that attack or to North Korea. Mercado Bitcoin has not linked the two.
Brazil's data protection authority could expect a notice if personal data proves to have been taken, Cointelegraph noted. The exchange says none was.
The aftermath
Mercado Bitcoin says no customer will lose money and that it will rebuy the missing coins with its own funds, helped by a $20 million investment from Tether and what it calls a strong cash position. That promise cannot be checked from outside. Reopening is being done in stages from 9 November, starting with a read-only view of accounts. Withdrawals and trading have no date.
More than $15 million of the stolen coins has been frozen by the exchange's count, while Chainalysis puts its own part at nearly $10 million. Most of the rest sits with an unidentified attacker who was seen selling smaller coins. The loss figure stays disputed: about $38 million from the exchange, more than $40 million from Hypernative, $46 million from Arkham and $49 million from Chainalysis.
The exchange says it is working with the competent authorities, but no arrest or charge has been reported. BitMart's smaller loss, if the link holds, would show one group working through several exchanges in a single morning.
What this teaches
- Coins left on an exchange sit in the exchange's wallets, and a promise to replace stolen ones depends on the firm's own money.
- Several trackers, several numbers. Early loss counts are estimates until the victim publishes one.
- Stablecoin issuers can lock stolen coins, which is why Tether and Circle froze money within hours, but coins on other networks can only be chased.
- A shared receiving address links two thefts. It does not name the thief.