Mercado Bitcoin Hack: $46M Drained, Withdrawals Frozen - Memeburn

While most of Brazil was asleep on November 2, 2026, attackers emptied wallets belonging to Mercado Bitcoin, the country's largest crypto exchange. The biggest transfers occurred between 06:19 and 06:53 UTC (3:19-3:53 a.m. São Paulo time). By that afternoon, blockchain analysts had traced approximately $46.3 million to the attacker, prompting the exchange to pause all deposits and withdrawals. As of the latest updates, Mercado Bitcoin hadn't specified when services would resume.

The hack came just four days after the record $6.3 billion theft at Binance, reigniting familiar questions about security in the crypto industry and who ultimately bears the financial loss. For Mercado Bitcoin's approximately 4.5 million users, the theft works out to about $10 per user—small compared to Binance's breach but still significant.

What the Hack Took

Mercado Bitcoin hasn't confirmed a loss figure, but security firm Hypernative first flagged about $40 million stolen. Later, blockchain analytics firm Arkham's tracking put the total near $46.3 million.

Security firms indicate the attacker didn't breach smart contracts but gained the ability to sign transactions, allowing ordinary transfers. The exchange posted its first statement on X, stating it found the breach "in one of our systems early this morning" and claimed "no harm to customers and no data breach."

Deposit Address Concerns

While Mercado Bitcoin claims no customers lost money, analysts have raised concerns about deposit addresses. Security researcher Gallic noted the attacker was sweeping funds from old deposit addresses—unique addresses exchanges provide for customers to send crypto into their accounts. CertiK researcher Dickson Wu added that the attacker sent tiny amounts of ether from 27,160 addresses to a single address, warning they "could also withdraw money from MB's customer deposit addresses."