Brazil's Mercado Bitcoin lost about $49 million on 17 chains. It says customers lose nothing
Mercado Bitcoin says it contained a security incident on November 2, 2026, and that no customer will lose assets. Chainalysis puts the theft at about $49 million and says close to $9 million has been frozen.
Key points
- Mercado Bitcoin said on November 2, 2026, that it found and contained a security incident in one of its systems overnight, with no customer losses and no data leak.
- Chainalysis, which works for the exchange, says an attacker drained about $49 million from wallets on 17 blockchains, moving in waves.
- Chainalysis says about $9 million was frozen within hours, including more than $4 million in USDT frozen by Tether.
What Mercado Bitcoin said
Mercado Bitcoin, which Chainalysis describes as Brazil's largest crypto exchange, posted an official statement on X at about 7:56 a.m. ET on November 2, 2026. It said it had quickly found and contained a security incident in one of its systems overnight.
The exchange stressed two points: customers suffered no losses, and no data leaked. It said it took preventive steps on deposits and withdrawals to protect users.
At about 9:24 a.m. ET it posted an update saying it was working to restore operations safely. To help others monitor and trace the funds on public blockchains, it shared the destination addresses it had identified.
At about 6:17 p.m. ET, a third post told users directly that they would not lose any assets because of the incident.
How the money left
Mercado Bitcoin has not published a loss figure. The blockchain analysis firm Chainalysis, which says the exchange is its customer, gave one. In a blog post dated November 2 and a post on X, it said about $49 million was stolen.
According to Chainalysis, the attacker began moving assets in the early hours of November 2 across 17 blockchains, draining them in waves. The largest amounts came from Bitcoin and Ethereum. Smaller networks, including Base, Tron and Polygon, were swept too.
Chainalysis says a Mercado Bitcoin director called its local expert at 2:30 a.m. ET to report the hack. Neither company has said how the attacker got into the system.
Frozen within hours
Stablecoins such as USDT and USDC can be frozen by the companies that issue them. That gives victims a short window to act. Chainalysis says it passed addresses and intelligence to Tether and to law enforcement, and that Tether froze more than $4 million in stolen USDT.
By morning, about $4 million in stablecoins was locked, Chainalysis says. Over the next hours the total reached about $9 million. The post's headline rounds this to nearly $10 million. Chainalysis also says it contacted Paxos, Anchorage Digital, Ripple and Circle about stablecoins they issue, but it does not say which of them froze funds.
Chainalysis also said on X that its investigators were working with industry partners to identify, freeze and disrupt the stolen funds.
Mercado Bitcoin incident, per Chainalysis
US$ million
Source: Chainalysis, November 2, 2026
Timeline
Attacker starts moving assets across 17 blockchains (Chainalysis).
A Mercado Bitcoin director reports the hack to Chainalysis (Chainalysis).
Mercado Bitcoin's official statement: incident contained, no customer losses, no data leak.
Mercado Bitcoin shares the destination addresses it identified.
Chainalysis says it is working with partners to freeze funds.
Mercado Bitcoin tells users they will lose no assets.
Chainalysis puts the theft at about $49 million.
LC Insight analysis
This section is our reading of the facts above, not a statement of fact.
- We think the speed of the freezes is the main lesson. Reporting the hack before dawn and sharing addresses early let issuers lock nearly a fifth of the stolen money the same day.
- Mercado Bitcoin's promise that users lose nothing means the exchange carries the loss itself. How it funds that, and how fast normal service returns, will decide how much trust it keeps.
- The largest tranches came from Bitcoin and Ethereum, which no issuer can freeze. The likely result is that the frozen share stays limited unless exchanges stop deposits from the traced addresses.
What's next
- A loss figure and cause from Mercado Bitcoin itself
- When deposits and withdrawals fully reopen
- Further freezes by Tether, Circle or other issuers
Disclaimer. This article is based on public information and the sources listed below as of the update time shown. It is for information only and is not investment, legal or tax advice. Figures may change as companies and authorities publish new data.
Sources
- Mercado Bitcoin on X, official statement (November 2, 2026, 7:56 a.m. ET; in Portuguese)
- Mercado Bitcoin on X, update with destination addresses (November 2, 2026, 9:24 a.m. ET; in Portuguese)
- Mercado Bitcoin on X, update to users (November 2, 2026, 6:17 p.m. ET; in Portuguese)
- Chainalysis, blog post on its response to the Mercado Bitcoin hack (November 2, 2026)
- Chainalysis on X, $49 million estimate (November 2, 2026, 7:47 p.m. ET)
- Chainalysis on X, tracking the incident (November 2, 2026, 12:17 p.m. ET)
