Mercado Bitcoin, Brazil's largest crypto exchange, confirmed a security incident on 2 November and paused deposits and withdrawals. Hypernative's preliminary analysis flags more than $40 million in suspicious transfers across 10 chains.
Four days after Binance lost $6.3 billion, the hackers moved south. Mercado Bitcoin, Brazil's largest cryptocurrency exchange, confirmed on Sunday 2 November that one of its systems had been hit by a cyberattack, and paused deposits and withdrawals while it investigates. The exchange has not said how much was taken. Blockchain security firm Hypernative has, provisionally: more than $40 million in suspicious transfers across at least 10 blockchains.
The market barely registered it. Total crypto market cap stood at $2.7 trillion at 17:00 UTC on 2 November, according to CoinGecko, down 0.3% on the day, with Bitcoin at $77,269. After the week it has had, $40 million does not move the index. For Mercado Bitcoin's customers, the question is narrower: when do withdrawals reopen.
Mercado Bitcoin's official statement, posted in Portuguese on X on Sunday, says the company "identified and quickly contained a security incident in one of our systems in the early hours of this morning." It makes two assurances: no customer suffered losses, and no data was leaked. Deposits and withdrawals were suspended "as a preventive protection measure."
That is the whole of the public record from the exchange. No loss figure, no attack vector, no timeline for restoring service.
Mercado Bitcoin was founded in 2013 and is Brazil's longest-running major exchange, part of the 2TM group that raised $200 million from SoftBank in 2021. It is one of the largest venues in Latin America by volume. A breach there is a regional story in the way a breach at a tier-two offshore exchange is not.
Hypernative, which monitors on-chain activity for exploits in real time, published a preliminary analysis on the same day. It identified more than $40 million in suspicious transfers potentially linked to the incident, spread across at least 10 blockchain networks including Bitcoin, Ethereum, Solana and Tron.
Two caveats attach to that number. The exchange has not confirmed it, and Hypernative's analysis does not establish whether every flagged transfer came from a wallet Mercado Bitcoin controls. Early estimates in exchange breaches tend to move in both directions: Binance's first figure was $5.6 billion before Arkham and the exchange itself settled closer to $6 billion, while smaller incidents sometimes shrink once internal transfers are stripped out.
Spreading an outflow across 10 chains is itself a signal. It is how an attacker complicates tracing and, with stablecoins, outruns issuer freezes. In the Binance case, Tether and Circle blacklisted $2.8 billion within an hour. There is no public word yet on whether any of the Mercado Bitcoin flows have been frozen.
The timing invites comparison but not necessarily connection. Binance's breach, on the evening of 29 October UTC, ran through a compromised engineer's laptop and a service container. Mercado Bitcoin has said nothing about its vector. The scales differ by two orders of magnitude. AMLBot, which tracked the Binance flows, said at the time that rumours of other exchanges being hit had "no on-chain evidence." That was Thursday; Sunday is a different day.
What the two share is the pattern of the response: confirm quickly, promise users are whole, pause withdrawals, say little else until the post-mortem. Binance reopened Bitcoin withdrawals within three days. Mercado Bitcoin has given no date.
Three things settle this story. The first is Mercado Bitcoin's own figure, which will come either in a follow-up statement or when withdrawals resume and users can see balances. The second is whether Hypernative or Arkham publishes an address cluster, which would let Tether and Circle act on any stablecoin portion. The third is the regulator: Brazil's central bank finalised its crypto service provider rules earlier this year, and a breach at the market's largest licensed venue is the first live test of how the Banco Central responds.
Until then, the honest summary is the exchange's own: an incident, contained, customers covered, details to follow.
No comments yet
