Mercado Bitcoin hot wallets and deposit addresses (November 2026) hack — November 2026

In the early hours of 2 November 2026 hot wallets belonging to Mercado Bitcoin, one of Brazil’s largest crypto exchanges, were emptied on ten blockchains. The exchange said at 12:56 UTC that it had identified and quickly contained a security incident in one of its systems, that customers had lost nothing and no data had leaked, and that deposits and withdrawals were suspended. Security firms said the theft used ordinary transfers rather than a smart contract exploit.

Bitquery counts $48.5 million taken, valued at the time of each transfer: $29.71 million on Ethereum, $8.30 million in bitcoin, $3.22 million on Solana, $2.12 million on Stellar and smaller amounts on Arbitrum, Tron, Polygon, Avalanche, XDC and BNB Chain. The hot wallets on all ten chains paid the attacker within 25 minutes, between 06:24 and 06:50 UTC. From 12:10 UTC the attacker also emptied 35,853 customer deposit addresses on Ethereum, about $261,000 in all, and kept doing so for more than two hours after the exchange’s statement. CertiK’s Dickson Wu reached the same conclusion: whoever did this can move money out of the exchange’s deposit addresses.

Late on 2 November Mercado Bitcoin put the assets involved at about $38 million, said it had blocked $11 million with Tether, Circle, Paxos, BRL1 and Chainalysis, and assured customers they would lose nothing. Bitquery could see $7.3 million frozen on-chain by Tether and Paxos, the recovered figure here, and no freeze by Circle, leaving about $4.29 million of USDC and EURC free to move. Most of the rest, including 106.07 BTC, had not moved by that evening. Services stay suspended until the exchange says it is safe to resume.