Mercado Bitcoin Suffers Cyberattack as Researchers Flag $40 Million in Suspicious Crypto Transfers - CyberSecurityNews
Brazilian cryptocurrency exchange Mercado Bitcoin suspended deposits and withdrawals on November 2, 2026, after detecting a security incident in one of its systems.
Blockchain security firm Hypernative flagged more than $40 million in suspicious transfers across at least 10 blockchains, raising questions about the scope of the breach. The exchange has not confirmed that amount as its actual loss.
In its official statement, Mercado Bitcoin said it quickly contained the incident early Monday morning. The company said customers suffered no harm and no data leaked.
The service suspension was described as a protective measure while its teams investigate, trace assets, and work with authorities.
Suspicious transfers
According to reports, Opsek founder Pablo Sabbatella shared findings describing transfers from wallets linked to Mercado Bitcoin into fresh addresses. The affected networks included Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain and Stellar.
Most of the reported outflows occurred between 06:19 and 06:53 UTC, a 34-minute window. Earlier Bitcoin activity reportedly began around 02:15 UTC, when funds from deposit addresses started moving to addresses linked to the suspected attacker.
The preliminary count included approximately 2,852 ETH, 106 BTC, 10,700 SOL and 6.7 million XLM, alongside more than 200 other tokens. These figures remain researcher estimates rather than amounts verified publicly by Mercado Bitcoin.
Investigation status
Researchers described the movements as ordinary transfers rather than a smart contract exploit. That distinction puts attention on how the transactions received valid signatures. However, the available findings do not establish how the attacker obtained signing access or which internal system was compromised.
Mercado Bitcoin later published destination addresses covering Ethereum-compatible networks, Bitcoin, Solana, Stellar and Tron. The exchange said it released them to help identify and track funds on public blockchains.
The unresolved issue remains the gap between suspicious wallet movements and confirmed losses. Its statement that customers were unharmed should not be read as confirmation that no exchange assets were taken.
Related
