Brazilian exchange Mercado Bitcoin temporarily suspended deposits and withdrawals on November 2 after identifying what it described as a security incident in one of its systems. The exchange said it contained the incident quickly, that customers had not suffered losses and that customer data had not leaked.
Independent onchain observers estimate that more than $40 million in digital assets moved from wallets associated with the platform across multiple blockchain networks. That figure is not the same as a company-confirmed customer loss. The exchange has not publicly disclosed a final financial impact or a completed explanation of how unauthorized transfers were approved.
One incident, many chains
Reporting based on security researchers’ tracing describes outflows across at least ten networks, including Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain and Stellar. Mercado Bitcoin also published destination addresses for several ecosystems, allowing other investigators and service providers to monitor movements associated with the incident.
The significance of the multi-chain pattern is that it does not look like an isolated smart-contract error on a single application. Investigators have described transfers resembling ordinary signed transactions out of exchange-controlled wallets. That suggests the central question is how authority over those wallets or their signing process may have been compromised, but the exact access path has not been established publicly.
Security companies have cited slightly different snapshots and values. A $40 million estimate reflects one point in the tracing process; later reports put the figure higher. Volatile token prices, classification of affiliated wallets and subsequent asset movements can all change a running estimate. Readers should not treat an early round number as an audited loss statement.
Customer balances and exchange assets are different questions
Mercado Bitcoin’s statement that customers were unharmed is material and should not be omitted. It does not, however, answer every operational question about the event. An exchange can absorb an incident using its own resources, and some incidents affect funds held by a business rather than individual account balances. The company will need to explain the mechanism and the restoration of normal service before outsiders can assess its controls.
Deposit and withdrawal pauses prevent further movement while investigators check affected systems, but they also restrict legitimate customers from accessing their funds. That trade-off makes recovery communication important. At the time of the company’s initial statement, the pause was described as precautionary; customers should rely on the exchange’s current official status channels rather than assume a particular restoration time.
Frozen assets are not recovered cash
Tether’s chief executive said around $4.5 million in USDT associated with the incident had been frozen. Such intervention can stop identified tokens from moving, but a freeze is not automatically a refund. Asset tracing, ownership determination and any eventual release or recovery are separate processes.
The timing is sensitive because the sector was already responding to the much larger Binance security incident reported days earlier. There is no public evidence that the Mercado Bitcoin transfers were carried out by the same actor, used the same vulnerability or were coordinated. The coincidence is not an attribution.
What an effective postmortem needs to explain
Useful follow-up disclosures would identify the affected wallet roles, access vector, whether signing systems were segregated, the net asset impact, any remaining restrictions and how the exchange verified that customer balances were protected. An independent review could help distinguish a one-off credential failure from broader weaknesses in wallet operations.
For now, the verified story has two sides: the exchange has acknowledged and contained an incident, while third-party analysts are tracing a substantial movement of assets across chains. Reporting those facts together is more accurate than saying either that every customer lost money or that a security assurance alone closes the case.
Primary sources and verification
Mercado Bitcoin, official incident statement, 2 November 2026
Mercado Bitcoin, published destination addresses
CoinDesk, reporting and outside loss estimates, 2 November 2026
0xCERT, source-linked incident advisory, 2 November 2026
Suggested Optimisus internal links
Binance Says $6.3 Billion Was Affected After Attacker Reached Withdrawal Systems
