Mercado Bitcoin, Brazil’s largest crypto exchange, confirms cyberattack as tens of millions drain from the platform

What happened

• Mercado Bitcoin, which describes itself as the largest digital-assets investment platform in Latin America, with about 4.5 million customers, confirmed a cybersecurity incident in social media messages and suspended all deposits and withdrawals (The Record).
• Funds began leaving the platform late Sunday night, with the incident surfacing on Monday morning (The Record). Blockchain data cited by Bitquery via CoinDesk places the draining on 2 November 2026, with 36,042 Ethereum customer deposit addresses emptied between 12:27 and 16:46 UTC (PYMNTS).
• Mercado Bitcoin said it had contained the breach at 12:56 UTC, but blockchain data shows the theft continued for roughly four more hours (PYMNTS).
• The company said its teams were “investigating the case, tracking the assets,” shared destination addresses for the stolen funds, and pledged to restore the platform in the coming days (The Record). It later pledged to cover all user losses (PYMNTS).

What we know / don’t know

The loss figure varies by source and has grown over time.

• Blockchain security companies initially said more than $46 million left the platform late Sunday night; Mercado Bitcoin did not confirm that figure (The Record).
• By 5 November, blockchain-data firm Bitquery traced $48.6 million in stolen assets across 10 blockchains, “more than the $40 million first reported,” per CoinDesk as summarised by PYMNTS, which headlined the revision as roughly $8 million larger (PYMNTS).

Recovery efforts.

• Tether CEO Paolo Ardoino said the platform froze about $4.5 million stolen from Mercado Bitcoin, and other platforms froze about $2 million more (The Record).
• Partners Tether, Circle, and Chainalysis helped freeze more than $15 million in total (PYMNTS).
• Chainalysis said it is tracking the coins so the industry can “identify, freeze, and disrupt impacted funds” (The Record).

Were customers affected? Mercado Bitcoin said the attack did not harm customers and did not lead to a data breach (The Record). Several blockchain security experts disputed this, citing blockchain evidence that hackers siphoned funds from some customer wallets (The Record); Bitquery’s analysis describes 36,042 customer deposit addresses being drained on Ethereum (PYMNTS).

What we don’t know.

• The attack vector is not confirmed. PYMNTS reports only that the attacker appears to have accessed systems used to manage customer deposits (PYMNTS); The Record does not disclose how the attack happened (The Record).
• Attribution is not established. Neither source attributes the Mercado Bitcoin attack to a specific group; The Record only notes it occurred amid a wider wave of crypto theft, including a multibillion-dollar Binance theft days earlier that U.S. authorities blamed on North Korean hackers (The Record). CoinDesk, as summarised by PYMNTS, found ties to wallets believed to belong to the BitMart crypto exchange (PYMNTS).
• A BRL figure for the loss is not reported by either source.

Sources

• The Record: Largest crypto exchange in Brazil confirms cyberattack as millions flow out of platform (2 November 2026)
• PYMNTS: Mercado Bitcoin Hack $8 Million Larger Than First Reported (6 November 2026)