Mercado Bitcoin said it identified and contained a security incident in one of its systems on November 2, 2026, and paused deposits and withdrawals as a precaution. The company’s own statement, as relayed in the coverage this analysis draws on, said customers suffered no harm and that no data breach took place. Six days later, the headline that circulates most widely says the exchange is reopening after a week-long freeze. The record does not support that framing yet.

Several reports state that no restart date had been given, even as outlets including 24/7 Wall St. and Yahoo cover the story. Nobody has confirmed a full week of frozen withdrawals either. What the public record does show is a drain of tens of millions of dollars across ten blockchains, a partial freeze by stablecoin issuers, and a company still tracing assets. We covered the first hours of the response in our earlier piece on how the attack kept running four hours after containment, so this article takes a different angle. It asks what an exchange that goes dark means for the people holding balances there.

Below we separate what is confirmed from what is rumor, compare the competing loss estimates from Hypernative, Bitquery and the company itself, and explain the mechanics that decide whether a customer gets funds back. We also close with five predictions and a checklist. If you hold crypto on any centralized platform, the lessons apply well beyond this one case.

Don't miss new tech stories on Google

Add Shattered once in the Google app and our stories show up in your news suggestions.

What Mercado Bitcoin Has Confirmed About the Nov. 2 Incident

The confirmed core is short. Mercado Bitcoin identified and contained a security incident in one of its systems on November 2, 2026. It suspended deposits and withdrawals temporarily, and it described the step as a precaution. Its teams are investigating, tracing assets and coordinating with the relevant authorities. Those points appear consistently across the reporting that the story rests on.

The company also made a claim about customer impact. It said customers were not harmed and that no data breach occurred. That is a statement about customer data and customer outcomes, and it does not say that no funds left the platform. The distinction matters, because third-party blockchain analysts counted large outflows from wallets they tie to the exchange. A company can hold that its customers are made whole in principle while still acknowledging that assets moved to an attacker. Mercado Bitcoin has not, in the material available to us, spelled out how it will treat affected balances.

Later updates added detail. The company said roughly $11.2 million in assets had been blocked with help from industry companies and organizations. In a further update it named Tether, Circle, Paxos, BRL1 and Chainalysis among the partners involved in efforts to block assets, and it put the value of assets involved at approximately $38 million. Those two later figures come from the company, while the larger numbers come from outside analysts, which is why the table further down lays them side by side.

The Reopening Claim: What Is Unconfirmed

The headline version of this story says Mercado Bitcoin is reopening after a cyberattack froze withdrawals for a week. We checked each part of that sentence against the verified record. The attack part holds, in the sense that a security incident was identified. The reopening and the duration do not hold, at least not yet.

Several reports state that no restart date had been provided. Nothing we can verify shows the company confirming that withdrawals resumed. Equally, nothing confirms that the freeze lasted exactly one week. A pause that began on November 2 and was still in force when those reports were written could easily run past or fall short of seven days. Readers should treat one week as a rounded media shorthand, not a measured fact.

Two more items stay unconfirmed. No outlet in our verified set reports a specific customer reimbursement amount or a completed refund program. And Mercado Bitcoin itself did not call the event a hack. It used the phrase security incident. We follow that wording in this article, while noting that outside analysts describe large asset movements that look like theft.

How Big Was the Drain? Three Competing Numbers

Loss estimates differ because each source counts different things at different moments. Hypernative estimated that more than $40 million was drained from wallets it attributed to Mercado Bitcoin. Bitquery counted approximately $48.5 million leaving the exchange’s wallets across 10 blockchains. The company’s later update put the value of assets involved at approximately $38 million.

None of these figures is necessarily wrong. Analysts typically attribute wallets by clustering, so their totals depend on which addresses they include. Prices also move, and a token drained at one valuation can be reported at another by the time a company publishes its own tally. The conservative reading is that the incident involved a value somewhere in the high tens of millions of dollars, with the exact figure still unsettled.

Why the frozen amount grew from $7.3 million to $11.2 million

Bitquery reported $7.3 million frozen by Tether and Paxos at its observation point. Mercado Bitcoin later said about $11.2 million had been blocked. The gap fits a simple timeline. Freezes happen in steps as issuers and compliance firms trace funds, and a snapshot taken early undercounts the final total. The company’s list of partners, which includes Circle, BRL1 and Chainalysis beyond the two issuers Bitquery named, also suggests more parties joined the effort as the days passed. We cannot say how much of the $11.2 million overlaps with the $7.3 million, because neither source breaks that down.

Why the unfrozen figure still matters

Bitquery’s $41.2 million unfrozen figure is a snapshot, not a verdict. Funds that sit in stablecoins on cooperative chains can still be frozen later, while native assets such as Bitcoin or Ether can be moved and mixed with no issuer able to intervene. Anyone who wants to judge the final loss should watch for the company’s next tracing update rather than treat any single number as final.

Inside the Bitquery Timeline: 35,853 Ethereum Deposit Addresses

The most telling detail in the public record is a pattern, not a total. Bitquery reported that 35,853 Ethereum customer deposit addresses sent balances to the attacker between 12:10 and at least 15:44 UTC on November 2, 2026. That window runs more than three and a half hours, and the “at least” wording means the activity may have continued past the last observed transfer.

Why does that number stand out? Exchanges usually assign each customer a deposit address, then sweep funds from those addresses into larger wallets. Tens of thousands of addresses emptying to one destination suggests the attacker gained control over the sweeping mechanism or the keys behind it, rather than breaking into thousands of accounts one by one. That is our reading of the pattern, and Bitquery’s report on its own does not prove the method. Mercado Bitcoin has not described the technical cause.

The pattern also explains why the company can say there was no data breach and still lose assets. An attacker who moves funds does not need to read customer records. Account data, passwords and identity documents can stay untouched while the wallet layer fails. For customers, though, the distinction offers little comfort when the balance they see in the app depends on assets that no longer sit where they were.

Why Stablecoin Issuers Can Freeze Funds and Bitcoin Cannot

The $7.3 million that Tether and Paxos froze, and the broader $11.2 million the company later reported as blocked, show a structural feature of today’s market. Stablecoin issuers control the token contracts, so they can blacklist addresses and halt transfers. Native coins like Bitcoin offer no such switch. A thief who converts stolen stablecoins into a native asset can escape that net, and the shorter the response time, the more that matters.

We have tracked that dynamic in other cases this year. Our report on the T3 financial crime unit and its $250M in freezes looked at the same freezing tools in a different case. The Mercado Bitcoin response relies on a similar playbook of issuer cooperation and chain tracing. The named partners include Tether and Paxos, plus Circle, BRL1 and Chainalysis.

The speed gap is the weakness. Bitquery’s observation window shows deposit addresses draining for hours, while freezes depend on humans noticing, deciding and signing. Every hour of delay gives an attacker time to swap assets into forms that no issuer controls. For exchanges, the practical lesson is to pre-arrange emergency contacts with every issuer whose token they hold, before an incident forces improvisation.

“Security Incident” Versus “Hack”: Why the Wording Matters

Mercado Bitcoin chose the phrase security incident, and the choice has consequences. In legal and regulatory terms, the label shapes what the company must disclose, how insurers read a claim, and what customers can reasonably expect. A hack implies an outside attacker defeated defenses. A security incident covers that scenario and several others, including internal error or misuse. The company has not said which applies, and we will not guess.

Outside analysts use blunter language. Hypernative speaks of funds drained from wallets, and Bitquery speaks of balances sent to an attacker. Those descriptions point to hostile action, but they come from blockchain observation, not from the company’s investigation. Only the investigators will know the root cause, and only a published post-mortem would let outsiders verify it.

For readers deciding how much to trust a platform, the useful test is transparency over time. Does the company publish dated updates with specific figures? Mercado Bitcoin has issued several, each with different numbers. That counts in its favor, though the shifting totals make it harder for customers to form a clear picture. A closing report that reconciles all the figures would settle much of the uncertainty.

No Data Breach, but Funds Moved: Reading the Statement Carefully

The company’s reassurance covers two separate topics, customer harm and data exposure. On data, the claim is narrow and plausible. Wallet-layer attacks do not require access to databases. Our report on a card-payments case, where four data types tied cards to wallets, deals with a data-side problem. Mercado Bitcoin sits on the other side of that divide, with funds moved and data reported intact.

On customer harm, the claim is harder to test. If the exchange covers every affected balance from its own reserves or insurance, customers suffer no loss even though assets left the system. That outcome is possible, and it would make the statement accurate in a practical sense. But the company has not published a reimbursement figure or a completed refund program, so the claim remains an assertion until withdrawals resume and balances reconcile.

Readers should hold both statements at once. The company’s account may prove correct, and independent numbers still show a serious loss event. Trust, in this situation, should rest on observable actions such as reopening withdrawals, publishing reconciliations and naming who bears the loss. Our security coverage tracks how those actions play out across other incidents.

What Happens to Your Crypto When an Exchange Goes Dark

When a platform suspends withdrawals, your position depends on how it holds your assets. On most centralized exchanges, the balance in your account is a claim on the company, backed by pooled wallets that the company controls. You do not hold the private keys. That means your access runs entirely through the platform’s systems, and a pause freezes you in place no matter how healthy your account looks.

If your coins sit in a custodial balance

You cannot move funds until the company reopens withdrawals, and you have little leverage over timing. Trading may also stop, so you lose the ability to sell into a falling market or hedge. Prices elsewhere keep moving while your balance sits still. The risk is not only theft. It is also the opportunity cost of an asset you cannot touch for an unknown period.

Your claim’s strength depends on whether the company has reserves to cover the shortfall, whether insurance applies, and what its terms of service say about losses. Those details vary by platform and jurisdiction. In the Mercado Bitcoin case, the company has said customers suffered no harm, but it has not published a completed refund program. Until it does, the safest assumption is that recovery depends on the company’s own balance sheet and the funds that tracing partners manage to block.

If you hold assets in your own wallet

Assets in a self-custody wallet stay under your control regardless of any exchange outage. A suspension at a platform you use does not touch coins whose keys you hold. That is the main practical difference between the two models. Self-custody brings its own duties, including backup management and phishing resistance, but it removes the single point of failure that a platform pause creates.

Custody Models Compared: Who Bears the Risk

The table below compares common ways to hold crypto, focusing on what happens during a platform outage like this one. It is a qualitative comparison based on how each model works in general, not on figures tied to any one provider.

Self-hosting is not a free pass. Our report on BTCPay Server thefts hitting 2.4.1 and older installs shows that people who run their own infrastructure can lose funds too, when they skip patches. The point of the comparison is not that one model is safe and another is doomed. Each model concentrates risk in a different place, and a sensible holder spreads exposure across more than one.

Historical Context: Exchange Incidents Keep Landing in 2026

The Mercado Bitcoin incident is one of several centralized-platform failures this year. We reported on an Arkéa hack that drained €100M into crypto, and our coverage of the $6.3B Binance theft examined how a single breach can shake confidence far beyond one company. We also covered a case where Nubank and Mercado Pago halted crypto transfers because of an external provider. Different causes, same user experience, funds you cannot move.

Patterns repeat. Attackers target the wallet layer or the infrastructure around it. Defenders respond with pauses, tracing and requests to issuers. Companies publish updates in stages, and the numbers shift as analysts and firms refine their counts. What changes is the speed of the response and the number of partners available to freeze assets, and that is where the Mercado Bitcoin case offers a modestly encouraging data point, since five named partners joined the effort.

Still, a response is not a recovery. Freezes catch only assets in cooperative formats, and Bitquery’s observation of $41.2 million unfrozen at its snapshot shows how much can slip past. The industry’s tools improve each year, but they work best when an exchange acts within minutes, and the 12:10 to 15:44 UTC window in this case suggests the drain outpaced that ideal.

Market Impact: Trust, Liquidity and Withdrawal Pauses

We have no verified price data on how Mercado Bitcoin’s incident moved markets, and we will not invent any. What can be said is qualitative. A withdrawal pause at any exchange reduces liquidity on that platform and pushes some customers toward competitors, and it raises the premium users place on proof that reserves exist. The reaction function is familiar even when the numbers are missing.

For competitors, the incident is both a threat and an opening. A rival exchange can win deposits by publishing reserve attestations and by describing its custody setup in plain terms. Yet an industry-wide wobble also invites regulators to ask harder questions about segregation of customer assets, incident disclosure timelines and the role of stablecoin issuers in emergency freezes. Those questions are likely to land on every platform, not only the one in the headline.

For stablecoin issuers, the episode reinforces a commercial point. Tether, Circle and Paxos all appear in the story, and their willingness to freeze funds is a selling point to regulated partners. It also raises a governance question about how much power one company should hold over assets that move on public chains. We expect that debate to sharpen as freezes become routine tools.

Insurance and Recourse: Who Pays if Balances Fall Short

Customers often assume that crypto held on an exchange carries deposit insurance like a bank account. In general it does not. Some platforms buy private cover for specific risks, and some keep reserve funds, but terms differ and exclusions are common. Mercado Bitcoin has not disclosed, in the material available, which mechanism would apply to affected balances.

The insurance market itself is reacting to this year’s large thefts. Our report on insurers scrutinizing crypto firms after the $6.3B Binance hack examines how insurers are scrutinizing the sector. If cover becomes harder to get or more expensive, exchanges may need to hold larger reserves of their own, which in turn changes how they price services.

Legal recourse varies by country and by the contract a customer accepted. Authorities are involved in the Mercado Bitcoin case, according to the company, but no outlet reports charges, arrests or a named perpetrator. We therefore make no claims about legal status for anyone. Customers who want clarity should read their account agreement and watch for the company’s formal notices.

What Users Should Do Now: A Practical Checklist

The steps below apply to Mercado Bitcoin customers and to anyone who keeps funds on a centralized exchange. None requires special tools, and none depends on information we lack.

  • Read the company’s official notices directly and ignore social media claims about a reopening date, since no date has been confirmed.
  • Screenshot your balances and transaction history so you can document your position if a claims process opens.
  • Avoid links in emails or messages about the incident, because phishing campaigns often exploit exchange outages.
  • Do not share seed phrases or approve wallet connections for anyone offering to speed up a refund.
  • Review how much you keep on any one platform and move long-term holdings to self-custody if that fits your skills.
  • Check whether any other service you use depends on the affected exchange, such as payment cards or lending products.

One more habit helps. Treat exchange balances as working capital, not savings. Amounts you need for trading or near-term spending belong on a platform, while amounts you plan to hold for years belong where an outage cannot touch them.

Five Predictions for the Weeks Ahead

These are our own forecasts based on how similar incidents have unfolded. They are not claims from Mercado Bitcoin or any outlet, and any of them may prove wrong.

  1. Withdrawals return in phases. Companies usually restore a subset of assets or functions first, then expand. We expect Mercado Bitcoin to follow that path once its tracing work and security review allow it.
  2. The loss figure stays contested. Three counts already exist, from Hypernative, Bitquery and the company. A final reconciliation may land near one of them, but analysts and the company will probably keep disagreeing about method.
  3. A reimbursement plan arrives with the reopening. The company said customers were not harmed, so a restart announcement will likely explain how balances are made whole. Until it does, treat that outcome as unconfirmed.
  4. More exchanges publish issuer contacts and freeze procedures. The response here leaned on partners such as Tether, Circle and Paxos. Rivals will want to show they have the same relationships ready.
  5. Customers split their holdings more. Repeated incidents this year push cautious users toward holding only trading balances on platforms and keeping the rest in self-custody.

The Takeaway on Exchange Outages and Your Crypto

The takeaway: the reopening-after-a-week headline outran the facts. What is confirmed is a November 2 security incident, a precautionary suspension, a company statement that customers were not harmed, and analyst estimates of a drain that range from more than $40 million to about $48.5 million. What is not confirmed is a restart date, a one-week duration or any completed reimbursement.

For customers, the case is a reminder of a simple rule. A balance on an exchange is a promise, and promises depend on the company’s systems working. The funds that stablecoin issuers froze show that coordinated response can claw back part of a loss, and the gap between $7.3 million, $11.2 million and the larger drain shows how much still escapes. We will update this piece when Mercado Bitcoin publishes a restart plan or a final tally.

Frequently Asked Questions

Did Mercado Bitcoin reopen withdrawals? That is not confirmed. Reports state that no restart date had been provided, and we found no verified source showing that withdrawals resumed. Check the company’s official channels for current status.

Were withdrawals frozen for exactly one week? No source confirms the duration. The company identified and contained the incident on November 2, 2026 and suspended deposits and withdrawals as a precaution. The one-week figure is a media shorthand.

How much was taken? Estimates differ. Hypernative estimated more than $40 million drained from wallets it attributed to the exchange. Bitquery counted about $48.5 million leaving wallets across 10 blockchains. Mercado Bitcoin later put the value of assets involved at about $38 million.

How much has been recovered or frozen? Bitquery reported $7.3 million frozen by Tether and Paxos, leaving $41.2 million unfrozen at its observation point. The company later said about $11.2 million had been blocked with help from industry companies and organizations.

Was this a hack? Mercado Bitcoin called it a security incident and did not use the word hack. Blockchain analysts describe large outflows consistent with theft, but the company has not published a root cause.

Will customers get their money back? The company said customers were not harmed and that no data breach occurred. No reimbursement amount or completed refund program has been reported, so the outcome for individual balances is not yet confirmed.

Which companies helped block assets? Mercado Bitcoin named Tether, Circle, Paxos, BRL1 and Chainalysis among the partners involved in efforts to block assets.

How can I protect crypto from an exchange outage? Keep only the amounts you actively trade on a platform, hold long-term assets in a wallet you control, and verify any message about the incident through official channels before you click or approve anything.

Laura Bennett edits and fact-checks shattered.io security and privacy coverage, making sure each piece is clear, current, and grounded in primary sources.