Brazil's Biggest Crypto Exchange Halts Withdrawals After a $40 Million Security Incident — Four Days After the Binance Hack

A second exchange halt in four days

Brazil's largest cryptocurrency exchange, Mercado Bitcoin, halted deposits and withdrawals on Monday, November 2, 2026, after what it called a security incident in one of its systems. The exchange said it identified and swiftly contained the incident early on Monday morning, that there was no harm to customers and no data breach, and that the suspension was a precautionary measure while its teams investigate, trace the assets and coordinate with authorities. It has given no reopening date and no loss figure of its own. The timing is what makes this story bigger than one exchange: it comes just four days after hackers drained about $6.3 billion from Binance on October 29, the largest crypto theft on record, which the FBI has attributed to North Korea's TraderTraitor group. There is, so far, no public evidence linking the two incidents and no attribution for the Mercado Bitcoin incident — but two major exchange incidents in one week is exactly the pattern that changes how users think about where they keep their crypto.

The money trail researchers found

While the exchange itself has not confirmed an amount, blockchain security researchers have published a detailed trail. Security firm Hypernative flagged more than $40 million in suspicious transfers from wallets it attributes to Mercado Bitcoin, spread across at least 10 blockchains — including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain and Stellar. An Arkham Intelligence analyst tracked the figure higher, to more than $46 million. The reported holdings of the attacker addresses include roughly 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and 77,000 AVAX, plus more than 200 other tokens. Most of the outflows moved in a 34-minute window between 06:19 and 06:53 UTC, though sweeps of the exchange's Bitcoin deposit addresses to the same attacker reportedly began earlier, at 02:15 UTC. Researchers describe the movements as plain transfers, not a smart contract exploit — which matters, because it means the open question is how the attacker obtained signing access, not which contract broke. Mercado Bitcoin later published destination addresses on EVM networks, Bitcoin, Solana, Stellar and Tron to help others track the funds.

Exchange: Mercado Bitcoin, Brazil's largest crypto exchange

Action: Deposits and withdrawals suspended, no reopening date given

Flagged outflows: More than $40 million (Hypernative); more than $46 million (Arkham analyst tracking)

Chains affected: At least 10, including Bitcoin, Ethereum, Solana, Tron and Stellar

Frozen so far: More than $4.5 million in USDT frozen by Tether

Exchange's position: No harm to customers, no data breach, incident contained

What the freeze tells us — and what to check

One number in this story is confirmed rather than estimated: Tether CEO Paolo Ardoino confirmed the stablecoin issuer has frozen more than $4.5 million in USDT linked to the incident. That is how the post-hack playbook now works — issuers and exchanges race to freeze what they can before it moves through mixers or swaps. For ordinary users, the practical checklist has not changed since the Binance hack, but it has become more urgent. First, know whether your funds are on an exchange or in a wallet you control — exchange halts freeze withdrawals, self-custody does not. Second, treat any exchange statement carefully: "no harm to customers" is not the same as "no exchange assets were taken," and the gap between suspicious wallet movements and confirmed losses is exactly what is still unresolved here. Third, watch for the reopening announcement from the exchange's official channels only — fake "support" accounts appear within hours of every major incident. The broader lesson of this week is uncomfortable but clear: exchange security is now a market-wide story, not a single-company story, and the venues that survive it will be the ones that can show, not just say, that customer funds are safe.

FAQ

How much was taken? The exchange has not confirmed a figure; Hypernative flagged more than $40 million in suspicious transfers across at least 10 blockchains, and an Arkham analyst tracked more than $46 million. Did customers lose money? The exchange says there was no harm to customers and no data breach; researchers' figures are estimates, not amounts verified by the exchange. Was this a smart contract hack? Researchers describe the movements as plain transfers, not a smart contract exploit; how the attacker got signing access is still unknown. Is it linked to the Binance hack? No public evidence links the two incidents, and no attribution has been made for the Mercado Bitcoin incident. When do withdrawals reopen? No date has been given; the exchange says it will update through its official channels.

Read more on Zimbuck: https://zimbuck.com/pages/zimbucknews and join the discussion at https://zimbuck.com/groups/zimbuckmarketnews. Related reading on the site: South Korea Calls Emergency Exchange Security Meeting After the $6.3 Billion Binance Hack, https://zimbuck.com/blogs/840/South-Korea-Calls-Emergency-Exchange-Security-Meeting-After-the-6 and After the $6.3 Billion Binance Hack, Exchanges Rewrite Their Security Playbooks, https://zimbuck.com/blogs/791/After-the-6-3-Billion-Binance-Hack-Exchanges-Rewrite-Their. Join Zimbuck at https://zimbuck.com to follow more crypto coverage.

This article is market news and general information only, not financial advice.