Mercado Bitcoin confirms a security incident; researchers trace multi-chain wallet drains
Mercado Bitcoin confirms a security incident and pauses deposits and withdrawals. Bitquery estimates $48.5M across 10 chains and reports continuing deposit-address sweeps; its figures are unverified. The exchange says customers suffered no loss and no data leaked. The entry point is unknown.
- Disclosed
- Nov 2, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Mercado Bitcoin customers and integrations using its deposit addresses; exchange hot wallets are implicated
- crypto
- In the wild
- Yes
- Exchange confirms an incident; Bitquery reports unauthorized wallet transfers.
What happened
Mercado Bitcoin’s public acknowledgement establishes a platform security incident, rather than just an unexplained transfer or an individual customer account theft. It does not disclose how the intruder entered, a compromised software version, the final financial impact or a recovery deadline. No published patch or user password-reset requirement is established by the statements read.
Bitquery reports hot-wallet outflows on ten chains and deposit-address sweeps continuing after the exchange’s rapid-containment statement. Its estimate is unverified: some source-wallet ownership comes from labels, behaviour and timing, particularly on Solana, Tron and Stellar. The $48.5M uses transfer-time prices and excludes tokens without a price; $1.21M comes from a thinly traded EVA token, and the report gives $47.2M when excluding it. Neither figure is an exchange-confirmed final loss.
The reported 35,853 Ethereum deposit addresses represent addresses, not unique customers. A transfer signed by an address does not distinguish stolen private keys from misuse of a signing service. The research’s master-key and shared-supplier suggestions are hypotheses, not established causes; its separate $298k outflow and BitMart label do not establish that BitMart was breached or that the cases share a supplier.
Bitquery estimates $7.3M frozen by Tether and Paxos at its observation cutoff. Frozen funds are not returned funds, and funds left in a wallet are not necessarily recoverable. The report’s FAQ rounds the issuer components to $5.9M and $1.5M, which do not sum exactly to its $7.3M headline. The discrepancy prevents treating these rounded figures as an audited total. The exchange’s customer-protection statement and its containment claim remain vendor claims, distinct from the researcher’s observations. No connection to the Binance incident is established.
Crime-scene timeline
Nov 2, 2026
Exchange acknowledges a security incident and preventive transfer pause
Its official statement says the incident in one system was contained quickly, customers suffered no loss and no data leaked. BitNotícias reproduces the full statement including the temporary deposit/withdrawal suspension.
Nov 2, 2026
Bitquery publishes a ten-chain investigation with a later observation cutoff
Its Ethereum observations run through 15:46 UTC, with other chains checked between 14:16 and 15:47 UTC. The report estimates $48.5M and 35,853 Ethereum deposit addresses swept through at least 15:44 UTC. These are unverified research figures, not an exchange-confirmed loss or customer count.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Mercado Bitcoin official statementPrimaryReadable public embed confirms the incident, rapid containment claim, no customer loss and no data leak. It truncates at the deposits/withdrawals sentence; the full suspension wording is reproduced by BitNotícias.
- Bitquery original multi-chain investigationPrimaryOriginal on-chain research estimates $48.5M, 35,853 Ethereum deposit addresses and $7.3M frozen, with observations through November 2 afternoon UTC. These unverified figures and wallet labels do not establish the entry point or final loss.
- BitNotícias report with the exchange statementReproduces the exchange’s temporary deposit/withdrawal pause and no-customer-loss statement; attributes the earlier preliminary $40M-plus estimate to Hypernative, rather than independently proving that amount.
- Mercado Bitcoin official public embedPrimaryPublic original embed actually read; confirms incident and containment/customer-loss/data-leak claims, but truncates before completing the transfer-pause sentence.