Brazil's Mercado Bitcoin suspends deposits and withdrawals, wallet drained across multiple chains in loss of more than $40 million
Brazilian crypto trading platform Mercado Bitcoin suspended deposits and withdrawals on Monday local time. Earlier, wallets linked to it were drained on at least 10 blockchains, and multiple security firms estimated losses at more than $40 million.
Monitoring shared by Pablo Sabbatella, founder of crypto security company Opsek, showed the largest wave of outflows around UTC 06:19–06:53, involving chains including Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC and Stellar. The attacker accounts now hold about 2,852 ETH, 106 BTC, 11,000 SOL, 6.7 million XLM, 77,000 AVAX and more than 200 other tokens. The transfers were ordinary transactions, not a smart contract vulnerability, and how the signing permissions were obtained remains unclear.
Mercado Bitcoin said in a statement on X that it had identified and quickly contained the security incident, that customer funds were not affected and there was no data leak, and that the suspension of deposits and withdrawals was a preventive measure; it is tracking assets and cooperating with authorities. The platform later published target on-chain addresses on EVM, Bitcoin, Solana, Stellar, Tron and other chains to aid tracking.
Tether founder Paolo Ardoino confirmed that about $4.5 million in USDT related to the incident had been frozen. There is currently no public evidence linking the incident to the recent Binance theft.
Original source:
Title: Mercado Bitcoin Halts Withdrawals Over Security Incident as Hypernative Flags $40 Million Drain Publisher: Unchained Publication date: 2026-11-02 URL: https://unchainedcrypto.com/mercado-bitcoin-halts-withdrawals-over-security-incident-as-hypernative-flags-40-million-drain/ Source type: media report Verification status: Full text read for this report, and cross-checked against Mercado Bitcoin's official X statement and the Hypernative monitoring reposted by Pablo Sabbatella (verified on 2026-11-02) Supporting content: Supports all core facts in the body, including the suspension of deposits and withdrawals, the estimate of more than $40 million drained across multiple chains, the outflow time window and asset holdings, ordinary transactions rather than a contract exploit, the contents of the official statement, the published addresses and Tether's freezing of USDT, as well as no public link to the Binance incident
ABAB AI Insight
Mercado Bitcoin is Brazil's largest cryptocurrency exchange. It was founded in São Paulo in 2013, and public information shows that its customer base has exceeded 4.8 million. In July 2026, Tether invested $20 million in it through strategic growth financing to help expand payment infrastructure, tokenized investment products, lending and cross-border business. In this incident, the platform stressed that customer funds were not affected and that no data was leaked, and characterized the suspension of deposits and withdrawals as a preventive measure while proactively publishing target addresses across multiple chains to assist tracking.
Hypernative, as reposted by Opsek founder Pablo Sabbatella, described the outflows as ordinary transfers and not a smart contract vulnerability, and said it remained unclear how the attacker obtained signing permissions. This suggests the issue is more likely to lie in hot wallet or system permission management rather than a publicly visible on-chain code flaw. Tether CEO Paolo Ardoino confirmed the freezing of about $4.5 million in USDT, which is one of the few verifiable external recovery actions so far; the exchange itself has not disclosed a specific loss amount.
Compared with the October 29 theft of about $6.3 billion from Binance's hot wallets, both incidents involved multi-chain ordinary transfers, misuse of hot wallet signing permissions, and occurred within a short period. But the scale differs by two orders of magnitude. Mercado Bitcoin has not confirmed a loss figure, nor has it publicly attributed the incident, and there is currently no public evidence showing a connection between the two. The Binance incident has been attributed by the FBI and other agencies to a North Korea-related organization, while this one remains unattributed.
This incident has changed Mercado Bitcoin's short-term operating status: the suspension of deposits and withdrawals has blocked customer inflows and outflows, and the platform must at the same time handle asset tracing, coordinate with authorities, and explain to customers that there was no customer loss. For smaller regional exchanges, once signing permissions for centrally managed multi-chain hot wallets are obtained, cross-chain draining can be completed within dozens of minutes; the freezing ability of stablecoin issuers such as Tether has become one of the few externally enforceable restrictions that can take effect immediately. Indicators to watch include whether the exchange discloses the total loss amount, the timetable for restoring customer funds, and whether the attacker's addresses later show large-scale swaps or cross-chain transfers.
ABAB News · Cognitive Law
Ordinary transfers draining multi-chain hot wallets often point to signing permissions rather than public contract vulnerabilities.
An exchange may state that customers were unharmed and publish addresses to assist tracking, but the total loss still awaits the exchange's own confirmation.
Stablecoin issuers can freeze part of the assets within hours, making this one of the currently verifiable external restrictive measures.