What happened
On 2 November 2026, Mercado Bitcoin said it had contained a security incident in one of its systems. The Brazilian exchange paused deposits and withdrawals while it investigated, traced assets and worked with authorities. It said customers had not lost funds and no data had leaked.
Independent estimates are higher than anything the exchange has confirmed. Chainalysis said an attacker moved about $49 million across 17 blockchains, with the largest amounts coming from Bitcoin and Ethereum. The tracing company said its work helped freeze nearly $10 million. Mercado Bitcoin has not published a final loss total or a technical explanation of how the transfers were authorized.
The exchange later published destination addresses for transfers on EVM networks, Bitcoin, Solana, Stellar and Tron. Publishing addresses helps investigators and other services identify the funds. It does not by itself prove how much was taken or who controlled the transfers.
Newsroom estimates range from more than $40 million to about $49 million. The difference reflects when the wallets were measured and which networks and tokens were included. Until Mercado Bitcoin publishes a reconciled account, the most defensible description is a range, not one exact loss figure.
What it changes
Customers temporarily lost the ability to move assets into or out of the exchange. Mercado Bitcoin's public status history shows that login, registration, the mobile app and the trade API returned to service at 19:32 UTC on 2 November. That page does not record whether cryptocurrency withdrawals had reopened.
For a bitcoin holder, the important boundary is custody. A balance shown by an exchange is a claim on that company until a withdrawal confirms to an address the customer controls. If the exchange pauses transfers, the customer cannot independently move the bitcoin even when the balance remains visible.
Using self-custody removes the exchange as a withdrawal gate. It also makes the owner responsible for backups, key security and checking transactions. Our wallet guide explains those responsibilities before anyone moves funds.
The incident also shows why asset freezes have limits. Stablecoin issuers can block tokens at selected addresses. Bitcoin has no issuer with that power. Chainalysis said the largest tranches included BTC and ETH, which makes tracing possible but unilateral freezing impossible.
What it does not change
There is no evidence that the Bitcoin protocol, Bitcoin signatures or a self-custody wallet were broken. The reported bitcoin moved from infrastructure associated with a custodian. The unresolved question is how someone gained authority to make those transfers.
Nearly $10 million frozen is not the same as nearly $10 million returned. A freeze can stop centrally issued tokens from moving, but recovery still depends on legal authority, cooperation and proof of ownership.
Mercado Bitcoin's statement that customers suffered no losses is also not an independent audit. Cointelegraph reported that incident-linked addresses continued receiving funds after the pause and cited a researcher who said some deposit addresses could be moved. The exchange repeated that customer funds were safe but did not answer the outlet's questions about those later transfers.
No attacker has been identified publicly. The event followed the Binance theft by several days, but CoinDesk found no public evidence connecting the two. Similar timing is not attribution.
Context
Five independent newsrooms reported the same core event. Bitcoin Magazine and Decrypt confirmed the service pause and separated the exchange's claims from outside estimates. The Block reported an estimate of about $46.3 million and tracked early stablecoin freezes. CoinDesk examined transfers on at least ten networks. Cointelegraph followed movements after the suspension.
The reports agree that assets moved from Mercado Bitcoin-associated wallets on 2 November and that the exchange paused deposits and withdrawals. They disagree on the amount and do not establish a root cause. The customer-impact claim remains contested, while the public evidence supports neither attacker attribution nor a connection to the Binance breach.