TL;DR: Brazil’s Mercado Bitcoin froze deposits and withdrawals on November 2 after security researchers say more than $40 million moved out of the exchange across at least ten blockchains in a short window. The company says no customer data was exposed and part of the funds have already been frozen, but the timing is rough. This is the second major exchange hack to hit headlines in under a week, right behind Binance’s multibillion dollar breach.
What happened at Mercado Bitcoin
Mercado Bitcoin, one of Brazil’s best known crypto exchanges, paused all deposits and withdrawals on Monday after noticing unusual outbound transfers across multiple blockchains. The company posted on X that it had “identified and swiftly contained” a security incident, adding that there was no harm to customers and no data breach. Deposits and withdrawals are paused “as a precaution while teams investigate, track the assets and coordinate with authorities,” according to the statement.
Security researchers tell a less tidy story. Blockchain investigation firm Opsek, run by Pablo Sabbatella, published a report estimating the loss at more than $40 million, spread across at least ten chains including Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain, and Stellar. Opsek’s numbers point to roughly 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM, and 77,000 AVAX moved out, along with more than 200 other tokens. The bulk of the outflows reportedly happened in a tight window between 06:19 and 06:53 UTC, which is a brutal half hour for any exchange’s risk team to watch unfold.
What makes this one different from a typical smart contract exploit is that the transfers look like plain, ordinary transactions rather than a contract being tricked into releasing funds. That points toward someone getting hold of signing access to hot wallets rather than finding a bug in code, though Mercado Bitcoin has not said how the attacker got in, and nobody outside the company has full visibility into that yet.
The response so far
Mercado Bitcoin has published a list of destination addresses tied to the stolen funds across EVM chains, Bitcoin, Solana, Stellar, and Tron, the standard move exchanges make so other platforms and law enforcement can flag or freeze anything that touches those wallets. It appears to be working, at least partially. Tether CEO Paolo Ardoino confirmed that his company froze $4.5 million in USDT linked to the incident, which is a meaningful chunk recovered before it could be laundered through swaps or bridges.
There is no public attribution yet. Nobody has pinned this on a specific group, and there is no confirmed link to the North Korean TraderTraitor group that the FBI blamed for the Binance hack. Given how often exchange breaches eventually trace back to the same handful of state-linked crews, that connection is worth watching for, but right now it is speculation and nothing more.
Who is Mercado Bitcoin, and why this matters locally
Mercado Bitcoin has been around since 2013 and is one of the oldest and most recognized crypto exchanges in Brazil, serving millions of retail users who treat it the way American users treat Coinbase or Kraken. That reputation is exactly why a freeze like this draws attention fast. Brazil has one of the largest retail crypto markets in Latin America, and a chunk of that user base is not deeply technical, meaning they trusted the exchange to hold their coins securely rather than managing private keys themselves. When a platform with that kind of trust halts withdrawals, even temporarily and even with a reassuring statement attached, it tends to rattle users well beyond the exchange’s own customer base.
Brazilian regulators under the Central Bank and the securities regulator CVM have been tightening their framework for virtual asset service providers over the past couple of years, and an incident of this size, at a platform this well known, is the kind of event that tends to accelerate stricter custody and reserve disclosure requirements rather than slow them down. Expect this to come up in whatever regulatory review of the exchange sector follows.
A rough stretch for exchange security
The timing is what stings. Binance customers are still dealing with the fallout from a breach north of $6 billion that forced a staged withdrawal reopening, as we covered when Binance confirmed roughly 90 percent of customer funds recovered and later when investigators traced $242 million moving through Tron in a 48 hour span that the FBI’s own blocklist had missed entirely. Mercado Bitcoin’s numbers are nowhere near that scale, but a $40 million loss at a national exchange is still a serious hit, and it lands at a moment when users are already jumpy about where their coins are sitting.
For everyday traders, the lesson here is not new but it keeps getting proven right. Centralized exchanges are a convenient place to buy and sell, but holding meaningful amounts of crypto on any platform, even a well regarded one, carries counterparty risk that a self custody wallet does not. Hot wallet compromises like this one, whether from a stolen private key, a compromised employee account, or a social engineering attack nobody has disclosed yet, keep happening because the payoff for attackers is enormous and exchanges have to balance withdrawal speed against security friction.
Mercado Bitcoin says it is coordinating with authorities, and Brazilian regulators have gotten more aggressive about crypto oversight over the past couple of years, so expect some kind of public update or regulatory inquiry in the coming days. Whether withdrawals resume within hours or stretch into a longer freeze will depend on how confident the exchange’s security team is that they have fully locked the attacker out, not just stopped the bleeding.
The bottom line
A $40 million theft is not the kind of story that moves global crypto prices, but it is exactly the kind of story that should move how individual users think about where they park their coins. Two major exchange breaches inside of a week is not a coincidence worth shrugging off, it is a pattern. Until exchanges can show they have closed whatever gap let this happen, the safest assumption for anyone holding serious money in crypto is that convenience and security are still pulling in opposite directions, and right now security is losing more often than it should.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
