Mercado Bitcoin Hack: $46M Drained, Withdrawals Frozen

Vincee Cole

Updated 4 November 2026
7 mins read

The Mercado Bitcoin hack pulled an estimated $46.3 million from Brazil's largest crypto exchange on November 2, and deposits and withdrawals are still frozen. The exchange says customers lost nothing, but outflows continued for hours. You'll see what was taken, how much can be frozen, and what to check if you hold funds there.

Table of Content

Xiaomi 17T vs Galaxy S26 FE (2026): Cheaper Phone Wins

Oct 31
6 mins read

Honor Win RT vs POCO F8 Pro: The $176 Cheaper Phone Has 61% More Battery, but Only the POCO Is Easy to Buy

Oct 26
10 mins read

Sonos Ace Ultra vs Bose QuietComfort Ultra (2nd Gen): Same $449, Different Buyer

Oct 31
5 mins read

Vivo's Next "s" Phone May Get a Pro Max-Size 2K+ Screen

Oct 30
5 mins read

Honor WIN2 vs POCO F9 Ultra: Cooling or Cameras in 2026

Nov 4
5 mins read

What Happened, Hour by Hour

The exchange posted its first statement on X, saying it had found the breach “in one of our systems early this morning.” It added that there was “no harm to customers and no data breach,” and that deposits and withdrawals “are paused as a precaution.” It also said it’s investigating, tracking the stolen assets, and working with the authorities.

Security firms say the attacker didn’t break a smart contract, the self-running code behind many crypto apps. Instead, the funds left through ordinary transfers, which suggests the attacker gained the ability to sign transactions. Nobody has said how that happened, and no group has been blamed.

What the Mercado Bitcoin Hack Took

Mercado Bitcoin hasn’t confirmed a loss figure, so the estimates come from outside analysts. Security firm Hypernative first flagged about $40 million. Later, blockchain analytics firm Arkham’s tracking page put the attacker’s haul near $46.3 million. The gap is mostly timing, because the total kept growing through the day.

Here’s what the attacker was reported to hold, with our own dollar math where prices are available:

Our bitcoin math lines up almost exactly with Arkham’s own $8.24 million estimate for the stolen bitcoin, which gives us more confidence in the totals. Gallic also said the attacker was selling memecoins and smaller tokens, likely because those are harder to trace once converted.

For scale, Mercado Bitcoin had about 4.5 million users as of July. Spread across all of them, the theft works out to about $10 per user. That’s small next to Binance’s loss, but it’s still the kind of hole an exchange has to cover from its own funds.

“No Customer Losses” vs the Deposit Address Problem

This is the part that doesn’t fully add up yet.

The exchange says no customer lost money. It’s likely true in a narrow sense: if the stolen coins came from Mercado Bitcoin’s own hot wallets, the online wallets an exchange uses to process withdrawals, then the company takes the loss, not you. That’s what Binance said, too.

However, two analysts described something more worrying. Gallic said the attacker was sweeping funds from old deposit addresses. A deposit address is the unique address an exchange gives you to send crypto into your account. The exchange controls the keys to it, then moves the money into its main wallets. Separately, CertiK researcher Dickson Wu said the attacker sent tiny amounts of ether from 27,160 addresses to a single address, and warned that whoever did this “could also withdraw money from MB’s customer deposit addresses.”

Here’s why that matters to you. If an attacker can reach deposit addresses, any coins sent to them could be at risk until the exchange replaces them. That, in our view, is the most likely reason Mercado Bitcoin froze deposits as well as withdrawals. Mercado Bitcoin didn’t respond to questions about the continued transfers, so the company’s own explanation is still missing.

How Much Can Be Frozen? Less Than at Binance

When crypto is stolen, the first defense is freezing it. That works well for stablecoins, coins pegged to the dollar, because the companies that issue them can block specific addresses. It doesn’t work for Bitcoin or Ether, which no company controls.

Tether CEO Paolo Ardoino said on X that his company froze more than 4.5 million USDT linked to the incident. By 16:42 UTC, Tether and Circle together had frozen about $6.2 million. Late on November 2, on-chain analyst Specter claimed coordinated efforts had raised the frozen total to more than $9 million across nine assets.

The pattern is simple. The more of a hack sits in stablecoins, the more can be frozen. Mercado Bitcoin’s attacker held mostly Bitcoin, Ether, and smaller tokens, so most of the money is beyond anyone’s reach. Bitget’s case was even worse, as Circle and Tether froze only $318,000 of the $387 million taken. Freezing also doesn’t return funds automatically. It only stops the attacker from moving them.

If Your Money Is on Mercado Bitcoin, Do This Now

Don’t send crypto to an old Mercado Bitcoin deposit address. Wait until the exchange confirms deposits are open again and gives you a fresh address.
Follow only official channels. The exchange says it will post updates on X. Ignore direct messages offering to “recover” your funds, because scammers target users after every hack.
Screenshot your balances now. That gives you a record if anything looks wrong when withdrawals reopen.
Expect a phased reopening. Binance restarted withdrawals one network at a time, starting with Bitcoin. A similar approach here would be normal.
Think about long-term storage. If you’re not trading often, a hardware wallet for crypto storage keeps your keys offline, away from exchange hacks.

It’s also worth knowing that Brazil’s central bank has been phasing in new rules for crypto firms, including keeping customer assets separate from company funds. How those rules apply to this incident hasn’t been tested yet.

A Rough Week for Crypto Security

Mercado Bitcoin isn’t an isolated case. In the same week, Binance lost about $6.3 billion in the largest crypto hack on record, which the FBI blamed on North Korea’s TraderTraitor group. Prediction market Polymarket disclosed a smaller exploit of about $2.65 million. Investigators haven’t linked the Mercado Bitcoin attack to North Korea or to any of these incidents.

In our view, the size of this hack is manageable for an exchange with millions of users, and the quick freeze probably limited the damage. But the claim that customers weren’t affected needs a fuller explanation, especially about deposit addresses. Until Mercado Bitcoin publishes a root-cause report and a reopening plan, users should treat their balances there as temporarily out of reach, not lost.

Binance Wallet Referral Code

100 USDT Sign-Up Bonus

20% Lifetime Discount on Trading Fees
Code Valid: November 2026

Prices are as of 6:30 a.m. ET on November 2, 2026 (Solana as reported later that day) and may have changed since. This article is for information only and is not financial advice.

FAQs

Are crypto balances on an exchange insured like bank deposits?

No. In Brazil, the FGC (Fundo Garantidor de Créditos) protects certain bank deposits up to R$250,000 per person per institution, but it doesn’t cover crypto held at an exchange. The same is true in most countries. If an exchange loses customer funds and can’t cover them, there’s no government guarantee, which is why an exchange’s own reserves and insurance matter.

What is proof of reserves?

Proof of reserves is a report in which an exchange shows it holds enough crypto to cover customer balances. Usually, it publishes its wallet addresses and uses a cryptographic method so each customer can confirm their balance was counted. It’s a useful check, but it’s only a snapshot. It doesn’t always show an exchange’s debts, so it can’t prove the company is solvent on its own.

Can frozen USDT be returned to victims?

Yes, in some cases. When Tether freezes USDT, the tokens can’t be moved by anyone. Later, usually after a request from law enforcement, Tether can destroy the frozen tokens and issue the same amount to the rightful owner. That process can take weeks or months, and it only works for stablecoins with a freeze function, not for bitcoin or ether.

How do analysts trace stolen crypto?

Most blockchains are public, so every transfer can be followed. Firms like Arkham and Chainalysis label addresses that belong to exchanges, services and known hackers, then track where stolen funds move. Attackers try to hide the trail with mixers, cross-chain bridges and quick token swaps. Tracing doesn’t return funds by itself, but it helps exchanges block deposits from the attacker.

How can you tell if a crypto exchange is safer?

Look for regular proof of reserves, most customer funds kept in offline cold storage, and a license from your country’s regulator. Check its record with past security incidents and how it handled them. Also turn on two-factor login with an authenticator app and use withdrawal address allowlists. Even then, it’s safer to keep long-term holdings in your own wallet.

Vincee Cole

Vincee Cole is a technology journalist with four years of experience covering the full spectrum of modern tech — from consumer devices, artificial intelligence, to quantum computing, blockchain, and digital assets. His reporting cuts through complexity to deliver stories that are sharp, grounded, and relevant to both general readers and industry insiders. Previously, he worked with fintech research teams across Southeast Asia, analysing how emerging technologies are reshaping financial systems at scale.