Skip to main content
Mercado Bitcoin Drained Across 10+ Chains: What We Know
Sicherheit
Security
5 min read21 views

Mercado Bitcoin Drained Across 10+ Chains: What We Know

Floriano Righetti
Floriano Righetti

In the early hours of 2 November 2026, Mercado Bitcoin, Brazil's largest crypto exchange, lost control of funds held in wallets across many blockchains. The exchange paused deposits and withdrawals, published the destination addresses and says customers were not harmed. Here is what is confirmed, what is still estimated and what remains unknown.

What happened#

In its first official statement on X, at 12:56 UTC on 2 November, Mercado Bitcoin said (in Portuguese; quotes here are English renderings) it had "identified and swiftly contained" a security incident "in one of our systems" overnight. It said there was no harm to customers and no data leak, and that deposits and withdrawals were suspended as a precaution while its teams investigate, track the assets and coordinate with the authorities.

Chainalysis, which the exchange called in during the first hours, says an attacker began moving assets held across 17 blockchains, "working in waves." The largest tranches came from Bitcoin and Ethereum, with assets on Base, Tron, Polygon and other networks also swept. CoinDesk, which counts at least 10 chains, relays a report shared by the founder of security firm Opsek: the main outflows ran between 06:19 and 06:53 UTC and were plain transfers, not a smart contract exploit. In other words, whoever moved the funds had working signing access. How that access was obtained has not been disclosed.

An Arkham analyst, quoted by The Block, said the attacker was sweeping funds from older deposit addresses and selling memecoins and other altcoins. Several security researchers, cited by The Record, disputed the exchange's statement that customer funds were not touched, pointing to on-chain evidence of outflows from some customer wallets. The two positions are not necessarily incompatible if the exchange absorbs the loss, but we have not seen Mercado Bitcoin address the point directly.

The amounts, and who says what#

The figures differ by source and by time:

  • Chainalysis: an estimated $49 million taken.
  • Arkham data, via The Block: about $46.3 million.
  • The Record, citing blockchain security firms: more than $46 million.
  • CoinDesk, citing security firms: more than $40 million.
  • Mercado Bitcoin itself, at 23:17 UTC on 2 November: assets involved of "about US$ 38 million," with US$ 11 million already blocked together with Tether, Circle, Paxos, BRL1 and Chainalysis.

The freeze figures also moved during the day. Earlier on 2 November, Tether CEO Paolo Ardoino put the frozen USDT at about $4.5 million, as reported by CoinDesk, The Block and The Record. Chainalysis later wrote that Tether froze over $9 million and that nearly $10 million had been frozen overall. None of the totals is final, and the exchange has not explained how its $38 million figure relates to the higher third-party estimates.

What we verified on-chain#

Mercado Bitcoin published destination addresses for EVM chains, Bitcoin, Solana, Stellar and Tron on its help centre. We checked two of them directly at about 07:14 UTC on 3 November.

The EVM address (0xe485…2478) holds about 3.06 million USDT on Ethereum, and both the USDT and USDC contracts return "blacklisted" for it, so those tokens cannot move. The same address holds under 1 ETH, so the ether that passed through it has moved on.

The Bitcoin address (19qGps…DZp) has received 7 transactions totalling 106.07 BTC and has spent none of it. That matches the "106 BTC" in the report CoinDesk cites.

What remains unknown#

The root cause is not public. We do not know whether the compromise involved key material, a signing service, internal infrastructure or credentials. No attribution has been made, and CoinDesk notes there is no public evidence linking this incident to the recent Binance theft. The researchers' claim about customer wallets has not been answered in detail. In its latest update, Mercado Bitcoin said services will resume once full security conditions are in place, with timelines to be shared only through its official channels.

Our view#

Two points stand out. First, the attacker did not need a smart contract bug. Ordinary transfers signed with valid authority moved tens of millions across more than ten chains, most of it within about half an hour according to the report CoinDesk relays. For any custodian, the security perimeter is the signing path, including old deposit addresses that may sit outside daily attention. Second, what was frozen came mostly from centrally issued stablecoins, and early publication of addresses plus direct coordination with issuers and investigators made those freezes possible. Native assets such as BTC and ETH could not be stopped that way. Speed and transparency in the first hours matter, but they do not replace control over keys.

Sources#

Share this article

Related Articles

THORChain Halts After ETH Reorg Double Payout

Sicherheit2. Nov. 20264 min

THORChain Halts After ETH Reorg Double Payout

A one-block Ethereum reorg on 31 Oct made THORChain pay out 10 ETH it never received. What we verified on-chain, what is still open, and the finality lesson.

Artikel lesen