Mercado Bitcoin / Valor Econômico (São Paulo office; February2026 archive; crop).
Brazilian cryptocurrency exchange Mercado Bitcoin suspended deposits and withdrawals on Monday, November 2, after detecting a security incident, as blockchain security firm Hypernative estimated that at least $40 million had been compromised in wallets linked to the platform.
The exchange said it had quickly contained the incident and that customers had suffered no losses and no customer data had leaked. Those are the company’s statements; it has not confirmed Hypernative’s dollar estimate or disclosed whose assets were affected.
In its statement, reproduced by Brazilian business publication Exame, Mercado Bitcoin said access to its app was temporarily suspended as a protective measure. It said its teams were investigating, tracking assets and coordinating their response with authorities and relevant partners.
CoinDesk reported that wallets associated with the exchange had been drained across at least 10 blockchains. The report cited security researcher Pablo Sabbatella, founder of Opsek, who relayed findings on the outflows. Exame attributed the estimate of at least $40 million to Hypernative.
The reported movements involved several blockchain networks rather than a single token. The security findings described ordinary transfers rather than a smart-contract exploit, while leaving unanswered how signing access had been obtained. The exchange has not publicly confirmed that technical explanation.
Mercado Bitcoin later published destination addresses identified in movements related to the incident on EVM networks, Bitcoin, Solana, Stellar and Tron. It said the addresses were being shared to support identification and tracking, and that it was working to restore operations safely.
The company’s status page separately listed major outages affecting the trade API, login, mobile app and registration. The notices were opened between 12:52 and 12:59 UTC on Monday. Those operational notices confirm service disruption, not the amount or cause of any asset loss.
Exame reported that its staff could not sign into the app at 11:40 a.m. in Brasília. The company statements cited by the reports did not give a time for deposits and withdrawals to resume. The final loss figure, responsibility for the incident and the full route by which any assets moved remain under investigation.
JBizNews Desk | São Paulo
© JBizNews.com. All rights reserved. Unauthorized reproduction or redistribution is strictly prohibited.
