Mercado Bitcoin halts deposits and withdrawals after breach; outside trackers put losses at $40M–$46M

Mercado Bitcoin, Brazil's largest cryptocurrency exchange, suspended deposits and withdrawals on Monday, November 2, after what it called a "security incident" in one of its systems detected in the early hours of the morning. The exchange says no customer lost money and no data was leaked. Independent blockchain analysts put the stolen amount somewhere between $40 million and $46 million — a figure the exchange itself has not confirmed.

In a Portuguese-language statement on X, Mercado Bitcoin said it "identified and quickly contained a security incident in one of our systems" overnight, and that it suspended deposits and withdrawals "as a preventive protection measure." The exchange said it is investigating alongside "competent authorities," per Protos. It has not disclosed how the attackers got in, how much was taken, or when deposits and withdrawals will resume, saying only that it will post regular updates on X.

Those two claims — no customer losses, no data breach — come from the exchange, the party with the most interest in reassuring its users, and are not independently verified. They are also hard to square with the on-chain picture outside analysts describe.

What the on-chain trackers see

Blockchain security firm Hypernative flagged more than $40 million in suspicious transfers that may be tied to the incident, according to a preliminary analysis spanning at least 10 blockchains — including Bitcoin, Ethereum, Solana, and Tron — as reported by Decrypt. Arkham analyst Emmett Gallic put the figure higher, at "over $46 million and growing," according to Protos. Gallic said "lots of old deposit addresses are being swept by the hacker currently, while they sell off memecoins and altcoins" — a description of an attack still in motion rather than one fully contained.

The two estimates don't contradict each other so much as bracket a moving target: roughly $40 million by one firm's preliminary count, $46 million and rising by another analyst's, with the exchange declining to put a number on it at all. If Gallic's account of addresses still being swept is accurate, any figure quoted now is a snapshot, not a final tally.

Mercado Bitcoin did take one concrete step that outside observers could verify: it published the destination addresses it identified across five networks — EVM chains, Bitcoin, Solana, Stellar, and Tron — stating it released them only so others could identify and track the funds on-chain. Protos confirmed the exchange had shared the wallet addresses to help trace the stolen crypto.

Tether freezes 4.5M USDT

Tether CEO Paolo Ardoino said on X that the stablecoin issuer froze more than 4.5 million USDT connected to the incident. Because USDT is a centrally issued, dollar-pegged stablecoin, Tether can blacklist the addresses holding it so the tokens can't be moved. As Decrypt noted, a freeze does not by itself return the funds to their owner — it immobilizes them pending whatever recovery process follows.

That 4.5 million USDT is a fraction of even the lowest loss estimate, and it covers only one asset on the list. The rest — spread across Bitcoin, Solana, Stellar and the altcoins and memecoins Gallic described the attacker selling — sits on networks with no central party able to freeze it.

Key facts

• What happened: Mercado Bitcoin suspended deposits and withdrawals on Nov 2, 2026, after detecting a security incident overnight (Mercado Bitcoin via X, reported by Decrypt and Protos).
• Loss estimate: >$40 million flagged by Hypernative across at least 10 chains (Decrypt); >$46 million "and growing" per Arkham's Emmett Gallic (Protos). The exchange has not confirmed any figure.
• Chains hit: At least 10, including Bitcoin, Ethereum, Solana and Tron, per Hypernative (Decrypt). Destination addresses published on EVM chains, Bitcoin, Solana, Stellar and Tron (Mercado Bitcoin via X).
• Tether action: >4.5 million USDT frozen, per CEO Paolo Ardoino on X (Decrypt).
• Exchange's claims: No customer losses, no data breach (Mercado Bitcoin via X) — unverified.
• Status: Deposits and withdrawals remain suspended with no restart date given (Decrypt).

The real-world read

The gap between what Mercado Bitcoin is saying and what the chain is showing is the story. The exchange says customers suffered "no harm" and contained the incident "quickly" — yet Arkham's Gallic describes the attacker still actively sweeping old deposit addresses and dumping altcoins while that statement stood. An attack still draining funds is not a contained one, and "no customer lost money" is a claim the exchange cannot credibly make until it discloses what was taken and whether company funds, insurance, or user balances absorbed it. It has disclosed none of that.

Note who is saying what. The reassurances — no losses, no breach, incident contained — all originate with the exchange, which has every incentive to steady its users and has put no number behind any of them. The specific, quantified claims come from third-party trackers (Hypernative, Arkham) with no stake in the exchange's reputation. When the interested party offers comfort and the disinterested parties offer figures, the figures deserve more weight.

Tether's freeze announcement is worth reading in the same light. Ardoino publicizing a 4.5 million USDT freeze is a genuine mitigation, but it is also the issuer showcasing the control feature that is central to Tether's pitch — the ability to blacklist addresses. It is useful and it is marketing at once. And it is partial: 4.5 million USDT against a loss estimated near ten times that, with the remainder on chains no one can freeze.

What's conspicuously unsaid: the attack vector, the confirmed loss, whether balances are insured, and any restart date. The attribution is also open — Mercado Bitcoin has not said who is behind the breach, and has not linked it to the far larger Binance theft of late October. Any attempt to connect the two would be speculation at this stage.

Opinion, and whose

• Arkham's Emmett Gallic characterizes the hack as ongoing — "over $46 million and growing" — with the attacker still sweeping deposit addresses and selling memecoins and altcoins (via Protos). That is a read of live on-chain activity, not a confirmed final loss.
• Hypernative describes its >$40 million, 10-chain figure as a preliminary analysis (via Decrypt) — the firm's own caveat that the number may move.
• No forecasts on recovery odds, resumption timing, or attribution are offered by any named party, and none should be inferred.

Sources

• Decrypt (Tier 2, secondary) — exchange's suspension and "no losses/no breach" statement; Hypernative's >$40M, 10-chain preliminary figure; Tether's 4.5M USDT freeze per Ardoino; explanation that a freeze doesn't return funds; Binance context. Cites Mercado Bitcoin's and Ardoino's X posts (primary) and Hypernative (primary analyst).
• Protos (Tier 2, secondary) — $46M "and growing" estimate and the "sweeping deposit addresses" detail, attributed to Arkham's Emmett Gallic; confirmation that the exchange shared wallet addresses; the "competent authorities" line; Binance/Bybit context. Cites Arkham (primary analyst).
• Primary sources referenced within the above: Mercado Bitcoin's official X statements and Paolo Ardoino's X post. No sponsored or commissioned material was used; Tether's freeze announcement is noted above as doubling as issuer promotion of its blacklisting feature.

This is news reporting, not financial advice. Nothing here is a recommendation to buy, sell, or hold any asset.