Mercado Bitcoin, Brazil's largest crypto exchange, paused deposits and withdrawals after more than $40 million moved out of wallets linked to it, according to monitoring firm Hypernative. The exchange says the attack hit its hot wallets, was quickly contained, and that it will absorb the loss so customers lose nothing. It hasn't named an attacker or given its own figure.

Key facts

  • Who: Mercado Bitcoin, Brazil's largest crypto exchange
  • What: Funds drained from its hot wallets, the online wallets an exchange uses for day-to-day withdrawals; deposits and withdrawals paused
  • How much: More than $40 million, per Hypernative; the exchange hasn't confirmed a figure
  • When: Reported November 2, 2026
  • Source: Bloomberg, reporting the exchange's statement

Brazil's biggest crypto exchange pressed pause on November 2. More than $40 million had flowed out of wallets that monitoring firm Hypernative links to Mercado Bitcoin, and the exchange stopped deposits and withdrawals, Yahoo Finance reported. Mercado Bitcoin said the attack targeted its hot wallets, the always-online wallets exchanges keep for everyday withdrawals, and that it was contained quickly.

The exchange says it will absorb the loss and expects no customer to lose money, Bloomberg reported. It also shut its app for a short time and said no customer data was exposed.

What isn't known yet

Mercado Bitcoin hasn't given its own loss figure, named an attacker, or said when withdrawals return. Blockchain tracker Arkham has tagged addresses holding about $46.5 million as linked to the theft, PYMNTS reported. No one has tied it to the much larger Binance hack of October 29, which the FBI blamed on North Korea.

Two exchanges, one weak spot

Both thefts hit hot wallets. Exchanges keep most coins offline in cold storage and a smaller amount online so withdrawals go through fast. That online slice is what attackers go after, and it's why exchanges pause withdrawals the moment something looks wrong.

If you use Mercado Bitcoin

  • Wait for news inside the app. Fake "withdrawals are back" and "claim your refund" messages follow every exchange hack. Type the address yourself.
  • No one needs your password or codes to pay you back. A refund lands in your account. More on fake support scams.
  • Skip anyone selling "recovery." Paid recovery offers after a hack are a known trick. Here's how recovery scams work.

Coins you don't trade can sit in a wallet you control, away from any exchange's hot wallet.

Sources: Bloomberg, Mercado Bitcoin says it will absorb $40 million loss from hack (November 2, 2026), Yahoo Finance, Mercado Bitcoin halts withdrawals over security incident as Hypernative flags $40 million drain (November 2, 2026), PYMNTS, Mercado Bitcoin takes $40 million loss in latest crypto hack (November 2026).