Brazilian digital asset platform Mercado Bitcoin suspended deposits and withdrawals on Monday morning following a cyberattack that drained more than $46 million from the platform late on Sunday night. The Mercado Bitcoin cyberattack hit Latin America’s largest crypto exchange as security teams rushed to freeze illicit transactions across international digital asset networks.
Key points
- Attackers siphoned more than $46 million from Mercado Bitcoin late on Sunday, according to blockchain security analysts.
- The platform halted deposits and withdrawals on Monday morning while technical teams trace stolen assets.
- Stablecoin issuer Tether froze $4.5 million in connected funds, and other digital platforms blocked a further $2 million.
- Blockchain analysts disputed exchange claims that customer assets remained untouched, presenting transaction data indicating breaches of customer wallets.
Exchange halts transactions
Mercado Bitcoin detected the intrusion early on Monday, 2 November 2026, prompting administrators to halt all deposit and withdrawal mechanisms. The Sao Paulo-based exchange serves roughly 4.5 million registered users and ranks as the largest digital asset investment platform across Latin America.
Security analysts monitoring public ledgers identified unusual outflows starting late on Sunday evening. Over $46 million in tokens moved out of wallets managed by the company into unhosted addresses controlled by external operators.
Mercado Bitcoin shared destination addresses for the compromised funds publicly to alert other operators. The company said on social media that its technical teams had mobilised to contain the breach, map transaction paths, and coordinate enforcement efforts with domestic authorities.
The company also stated that the security incident resulted in no customer harm and caused no data breach. Management promised to reactivate transaction services in the coming days once systems pass internal audits.
Dispute over customer wallet access
Independent security analysts raised doubts about the official claim that customer holdings remained secure throughout the breach. On-chain researchers pointed to public blockchain evidence showing that the perpetrators extracted digital balances directly from wallets belonging to individual exchange clients.
Mercado Bitcoin did not confirm the total dollar value stolen in its formal notices, nor did spokespeople respond to questions regarding the contradictory on-chain movements. Discrepancies between public incident notices and ledger activity often emerge in the hours following an exchange breach, as forensic teams separate pooled reserves from segregated customer accounts.
Security firms tracking the flow noted that the threat actors split the incoming funds across multiple networks to slow tracking attempts. Such tactics resemble recent liquidity drains, including the incident where a Polymarket security breach forced an emergency halt to market operations.
International recovery operations
External network operators moved quickly to intercept the stolen assets before cash-out routes opened. Tether chief executive Paolo Ardoino confirmed that the stablecoin issuer blacklisted addresses containing approximately $4.5 million tied directly to the attack.
Other digital asset venues froze an additional $2 million following coordinate alerts circulated by the Brazilian platform. These quick freezes depend on centralised administrative keys built into specific smart contracts, allowing asset issuers to lock balances held by blacklisted wallets.
Blockchain intelligence firm Chainalysis deployed forensic teams to trace the remaining balance across multiple decentralised liquidity pools. The company said its analysts are monitoring asset paths to help trading venues and law enforcement agencies identify and freeze dirty balances before they exit through unregulated automated markets.
The targeting of investigative infrastructure has complicated response work across the sector. Chainalysis itself announced a cyber incident days earlier, after intruders used artificial intelligence-backed utilities to penetrate internal tools and collect user identification details, employee names, email addresses, and account permissions.
Rising pressure on digital asset security
The theft at Mercado Bitcoin follows several massive digital asset thefts during late 2026. Global market operator Binance lost $6.3 billion to an intrusion days earlier, an attack that United States federal investigators linked to state-backed hacking divisions from North Korea.
Federal law enforcement agencies, including the Federal Bureau of Investigation and the US Secret Service, have warned that state-sponsored syndicates rely on platform compromises to gather foreign currency reserves. Multiple international crypto trading hubs have suffered attacks exceeding $100 million in damages over the past six months alone.
Sophisticated intrusion groups regularly exploit vulnerabilities in exchange infrastructure, targeting administrative credentials, hot wallet signing keys, and third-party software integrations. Smaller regional hubs often face intense pressure when hit by these targeted incursions, because operational disruptions quickly threaten local market liquidity.
Mercado Bitcoin continues to monitor outgoing routes while technical staff review the code paths that allowed unauthorised access to its storage systems. Regulators in Brazil have yet to announce whether they will open a formal supervisory inquiry into the platform’s security controls.
