Key Takeaways
- • Chainalysis estimates roughly $49 million was drained from Brazilian crypto exchange Mercado Bitcoin across 17 blockchains, with Bitcoin and Ethereum making up the largest portions.
- • Coordinated action with stablecoin issuers, including Tether, froze about $10 million of the stolen assets, of which over $9 million was USDT.
- • The attacker moved most funds out of exchange-linked wallets in roughly 35 minutes, between 06:19 and 06:53 UTC, according to a report by Opsek founder Pablo Sabbate.
- • Mercado Bitcoin says customer balances are not affected, but deposits, withdrawals and services remain suspended with no confirmed reopening date.
Summary
Brazilian crypto exchange Mercado Bitcoin suspended deposits and withdrawals on Monday, November 2, 2026, after detecting heavy outflows from multiple wallets linked to the platform. According to findings from blockchain analytics firm Chainalysis, the exchange lost about $49 million across 17 blockchains, mostly Bitcoin and Ethereum. Initial company estimates had put the loss at about $40 million across at least 10 blockchains.
According to a report by security firm Opsek, founded by Pablo Sabbate, most of the funds left the platform within about 35 minutes, between 06:19 and 06:53 UTC. Wallets across Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC, Stellar and other networks sent nearly all of their funds to new addresses. The attacker accumulated approximately 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM, 77,000 AVAX and about 200 other tokens.
Mercado Bitcoin stated that user balances will not be affected. In a statement, the company said it had identified an occurrence on its platform in the early hours and had activated security protocols and temporarily suspended access to services as a preventive measure. The exchange has not provided a date for resuming services.
Chainalysis said the response began at midnight. At 2:30 a.m. ET, the company's director handed a list of unauthorized transactions to a specialist, and investigators contacted law enforcement within 30 minutes and shared addresses where stolen assets might be frozen. Efforts initially focused on stablecoins such as USDT and USDC, since their single issuers can block specific wallets. Tether froze about $9 million in USDT after identifying the stolen funds. Chainalysis noted that freezing becomes harder once funds are swapped into Bitcoin or Ethereum, and the investigation into the remaining stolen assets is ongoing.
According to a report by security firm Opsek, founded by Pablo Sabbate, most of the funds left the platform within about 35 minutes, between 06:19 and 06:53 UTC. Wallets across Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC, Stellar and other networks sent nearly all of their funds to new addresses. The attacker accumulated approximately 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM, 77,000 AVAX and about 200 other tokens.
Mercado Bitcoin stated that user balances will not be affected. In a statement, the company said it had identified an occurrence on its platform in the early hours and had activated security protocols and temporarily suspended access to services as a preventive measure. The exchange has not provided a date for resuming services.
Chainalysis said the response began at midnight. At 2:30 a.m. ET, the company's director handed a list of unauthorized transactions to a specialist, and investigators contacted law enforcement within 30 minutes and shared addresses where stolen assets might be frozen. Efforts initially focused on stablecoins such as USDT and USDC, since their single issuers can block specific wallets. Tether froze about $9 million in USDT after identifying the stolen funds. Chainalysis noted that freezing becomes harder once funds are swapped into Bitcoin or Ethereum, and the investigation into the remaining stolen assets is ongoing.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.