Mercado Bitcoin Hack: How $38–49 Million Left Brazil's Biggest Exchange and Why $11 Million Was Frozen

05/11/2026 5 min de lecture

274

Vues

Brazil's biggest exchange has suffered one of the largest crypto thefts of the year, and the numbers are still moving. Mercado Bitcoin was breached in the early hours of November 2, 2026, with the largest outflows occurring between 06:19 and 06:53 UTC. Deposits and withdrawals were paused, and they remain suspended with no reopening date announced.

The exchange itself has put the loss at about $38 million. Independent trackers put it higher: Hypernative at more than $40 million, Arkham at about $46.3 million, Bitquery at about $48.6 million across 10 chains, and Chainalysis at about $49 million. That range, from $38 million to $49 million, is the honest picture right now — and it is why this story needs to be told with the estimates side by side, rather than as a single settled figure.

How the money left

The scale of the sweep is what sets this hack apart. According to on-chain analysis, 36,042 Ethereum deposit addresses were emptied. These were old deposit addresses, many of them long unused, and they kept draining for about four hours after containment was claimed. That detail matters for users: an address you thought was empty, or forgotten, could still have been swept if it ever held funds linked to the exchange's systems.

The largest single movements tell the same story. About 2,852 ETH, worth roughly $6.52 million, left a hot wallet, alongside $2.99 million in USDT and $2.24 million in USDC. CertiK researcher Dickson Wu highlighted a separate tiny-ETH sweep across 27,160 addresses, a pattern that looks like an attacker systematically clearing small balances that most people would not notice individually, but that add up quickly at scale.

Once the funds were out, the attacker did not sit still. PEPE, AAVE, UNI, ONDO and ENA were dumped for ETH, and the attacker held 7,988 ETH, worth about $18.19 million. A further roughly $11.9 million in tokens was sold for ETH on November 3–4, and about $8 million in ETH was moved on November 3. In other words, this was not a single smash-and-grab. It was a multi-day operation to consolidate stolen assets into ETH, the easiest asset to move and to hide.

What was frozen, and what was not

About $11 million to $11.2 million has been frozen so far, with help from Tether, Circle, Paxos, BRL1 and Chainalysis. Tether alone froze more than $4.5 million in USDT. Together, Tether and Circle had frozen about $6.2 million by the afternoon of November 2, and Tether alone later froze more than $9 million. Those freezes are real progress, but they cover only a fraction of the total loss, and they work only for assets whose issuers can freeze them. ETH itself, once moved, cannot be frozen in the same way.

Mercado Bitcoin has said it will refund users, a promise reported by Decrypt, and that commitment will now be tested in the weeks ahead. For users, the key questions are practical: when will withdrawals reopen, how will losses be calculated, and will refunds be in full, in the original assets, or in another form? Until the exchange gives a reopening date, those questions remain open, and users should be wary of any message claiming to offer early refunds or help recovering funds. Scammers routinely target hack victims with fake support accounts.

One week, two huge hacks

The Mercado Bitcoin hack did not happen in isolation. Just days earlier, on October 29, Binance suffered a theft of about $6.34 billion, with about $2.85 billion frozen and, according to a preliminary report on November 3, about 98% replenished. The two events together make this one of the worst weeks for exchange security in crypto history, and they raise the same uncomfortable question for every user: how much should you keep on an exchange at all?

Exchanges are convenient, but they are also targets. A hot wallet, a deposit-address system, or a single compromised process can expose thousands of users at once. Cold storage, hardware wallets and keeping only trading funds on an exchange are not new advice, but after Binance and Mercado Bitcoin in the same week, that advice is harder to ignore. If you do keep funds on an exchange, check what protections it offers, whether it publishes proof of reserves, and how quickly it has communicated in past incidents. Mercado Bitcoin's pause, with no reopening date, is a reminder that access to your funds can disappear overnight.

Frequently Asked Questions

How much was stolen from Mercado Bitcoin?

Estimates range from about $38 million (the exchange) to about $49 million (Chainalysis), with Hypernative above $40 million, Arkham at about $46.3 million and Bitquery at about $48.6 million across 10 chains.

How much has been frozen?

About $11 million to $11.2 million, with Tether, Circle, Paxos, BRL1 and Chainalysis involved. Tether froze more than $4.5 million in USDT initially, Tether and Circle together about $6.2 million by November 2 afternoon, and Tether alone later more than $9 million.

Will users be refunded?

Mercado Bitcoin has said it will refund users, but no reopening date for deposits and withdrawals has been announced. Users should wait for official announcements and ignore unsolicited refund offers.

What should users do after an exchange hack?

Move funds you do not need for trading to cold storage, enable all available security on your accounts, and never share seed phrases or passwords with anyone claiming to help with recovery.

Références

Veuillez vous connecter pour aimer, partager et commenter !