Mercado Bitcoin Halts Withdrawals; Hypernative Flags $40M Drain
Brazilian exchange Mercado Bitcoin suspended deposits and withdrawals after a security incident, saying no clients lost money. Hypernative counts more than $40M in plain-transfer outflows across at least 10 chains, and Tether says it froze over 4.5M USDT.
Update: November 2, 17:22 UTC
Circle froze USDC on Polygon and Paxos froze gold tokens on Ethereum in connection with the Mercado Bitcoin hack, according to The Defiant, citing onchain records. A researcher quoted by the outlet put total freezes across issuers at near $7 million. Exchange withdrawals remain suspended.
Protos separately reported that losses stand at an estimated $46M and may still be growing.
Update: November 2, 16:46 UTC
Mercado Bitcoin has disclosed the specific on-chain address holding about 6.7 million stolen Stellar (XLM), according to U.Today. The outlet described the exchange as Brazil's biggest and put the hack at $40 million.
The figure matches the XLM balance Hypernative attributed to the attacker. U.Today's report ties that amount to a single named Stellar address, which lets exchanges and analysts track and flag the funds if they move.
Update: November 2, 16:42 UTC
CoinDesk reported that no attribution has been made for the Mercado Bitcoin drain and there is no public evidence tying it to the Binance hack, which the FBI attributed to North Korea's TraderTraitor group.
The report relayed by Pablo Sabbatella of Opsek also says the attacker holds about 77,000 AVAX, a holding not previously itemized. That sits alongside the ETH, BTC, SOL and XLM balances and more than 200 other tokens.
CoinDesk said Tether founder Paolo Ardoino confirmed the freeze of USDT linked to the hack. It did not specify which incident the freeze refers to.
Update: November 2, 16:17 UTC
Arkham says the attacker behind the Mercado Bitcoin hack holds about $46 million spread across 36 addresses, according to The Defiant. That is higher than the roughly $40 million figure from Hypernative and the amount Mercado Bitcoin said it would absorb.
The Defiant reported that Arkham's tracker groups the 36 addresses together. Mercado Bitcoin says customers suffered no losses, but The Defiant noted the exchange has not disclosed a total loss.
Update: November 2, 16:03 UTC
Mercado Bitcoin said it will cover a $40 million loss from Monday's hack itself and does not expect any customer losses, according to Bloomberg. The Brazilian exchange has now described the incident as a hack and attached a loss figure to it, matching the amount Hypernative flagged.
Bloomberg described the attack as the latest in a series hitting digital-asset platforms. CoinDesk reported that the funds were drained across 10 chains.
The reports do not say when withdrawals and deposits will resume.
Original report: November 2, 15:52 UTC
More than $40 million out the door, by one security firm's count, and "no losses to clients," by the exchange's. That is where Brazilian exchange Mercado Bitcoin stands after suspending deposits and withdrawals on Monday, Nov. 2, 2026, following what it called a security incident in one of its systems.
The $40 million figure comes from blockchain security firm Hypernative, which tracked outflows from wallets it attributes to the exchange. Mercado Bitcoin tells a calmer story. In an official statement on X at 12:56 UTC, it said it had identified and quickly contained the incident overnight, with no client losses and no data leaked. Its teams were investigating, tracing assets and coordinating with authorities.
What it has not done: give a loss figure, call this a hack, say whose funds moved, or confirm Hypernative's numbers.
What the chain shows
About 90 minutes after that statement, Mercado Bitcoin posted destination addresses on EVM networks, Bitcoin, Solana, Stellar and Tron, saying they were shared only so they could be identified and tracked.
The named Bitcoin address, checked on Blockstream at 14:58 UTC, showed about 106.07 BTC received across seven transactions. The first landed in a block at 05:42 UTC; the big one, 104.43 BTC, arrived in a single transfer at 06:41 UTC. Nothing had left the address at that point.
Hypernative's alert, shared on X by Pablo Sabbatella, describes the outflows as:
"plain transfers, not a smart contract exploit"
Hypernative, via Pablo Sabbatella
Translation: no code bug got farmed here. Whoever moved the funds could sign the transactions, and Hypernative says it is unclear how they got that access.
Where the funds sit
By Hypernative's count, the attacker holds about 2,852 ETH, 106 BTC, 10,700 SOL and 6.7 million XLM, plus more than 200 other tokens, spread across fresh addresses on at least 10 chains. Hypernative named nine: Ethereum, Bitcoin, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain and Stellar.
Most of it moved in a 34-minute window, 06:19 to 06:53 UTC. Sweeps of the exchange's bitcoin deposit addresses to the same attacker started hours earlier, at 02:15 UTC, according to Hypernative.
Tether says it froze more than 4.5 million USDT tied to the incident, and Ethereum and Tron records confirm blacklist actions against exchange-identified wallets. Deposits and withdrawals remain suspended.
Context
The incident came four days after billions drained from Binance hot wallets on Oct. 29. Neither Mercado Bitcoin nor Hypernative has tied the two together. In that case, Chainalysis has flagged automated laundering patterns it says it has never seen before.
For anyone with a bag parked on Mercado Bitcoin, the risk is plain: your coins are locked until the exchange restarts, and it has offered no loss figure and no timeline. Until it does, the gap between "no client losses" and "$40 million drained" stays open, and so does the question of whether house funds or customer assets took the hit.
