Mercado Bitcoin Pauses Withdrawals After Reported Multi-Chain Wallet Drain: What We Know and How to Reduce Exchange Risk

On 2 November 2026, the Brazilian crypto exchange Mercado Bitcoin paused deposits and withdrawals after what it described as a security incident. Security firms have estimated that more than $40 million in suspicious transfers may be linked to it. The situation is still developing, so this article separates what has been stated by the exchange, what has been estimated by third parties and what is still unknown. It then explains the general risk behind exchange incidents and what ordinary users can do.

What the exchange has said

According to reports by CoinDesk and Decrypt, Mercado Bitcoin said on X that it had identified and quickly contained a security incident in one of its systems. It described the suspension of deposits and withdrawals as a temporary, preventive measure. It also said no customers lost money and no data was leaked, and that it would post regular updates.

Later, the exchange reportedly published destination addresses on several networks (EVM chains, Bitcoin, Solana, Stellar and Tron) so others could track the funds on-chain.

Both outlets cite the exchange's posts on X. We could not open those posts ourselves, so please read the exchange's official channels for the exact wording.

What has been estimated by third parties

• The amount. The figure of more than $40 million comes from security firms, not from the exchange. Decrypt attributes it to a preliminary analysis by Hypernative covering at least 10 blockchains. CoinDesk relays a report from the security firm Opsek. Mercado Bitcoin has not confirmed the figure.
• The method. According to the Opsek report as relayed by CoinDesk, the funds were moved to fresh addresses in plain transactions rather than through a smart-contract exploit. This is a claim from that report, not a confirmed finding.
• The timing. The same report places the largest outflows in the early morning hours of 2 November, UTC.

These are early estimates and may change.

What Tether has done

Tether's CEO, Paolo Ardoino, announced on X that Tether froze more than 4.5 million USDT connected to the incident, according to both outlets. Decrypt notes that a freeze does not by itself return the funds to their owner.

What is not known

• How the attacker obtained access.
• Who is responsible. No attribution has been made.
• Whether the incident is connected to the Binance incident of late October 2026. Both outlets say the exchange has not linked the two, and CoinDesk says there is no public evidence of a link. We covered the other case in our article on the Binance security incident.
• When deposits and withdrawals will resume.

Why an exchange can lose funds on many chains at once

An exchange is not one wallet. To serve customers it holds assets on many networks, and each network needs signing keys. Some funds sit in "hot" wallets, which are connected to the internet so withdrawals can be processed quickly. Others are kept in "cold" storage that is offline.

When keys for many networks are managed by the same systems, people or devices, one weak point can affect several chains at once. Typical weak points include:

• Compromised devices or accounts used by staff who can approve transactions.
• Weak key management, for example keys stored or backed up where they should not be.
• Signing systems that approve transfers without enough independent checks.
• Too much value in hot wallets compared with what daily withdrawals require.

We do not know which, if any, applies to this case. They are general examples of why multi-chain losses can happen, not findings about Mercado Bitcoin.

What this means for ordinary users

An incident at an exchange is a custody risk: when you leave coins on a platform, you rely on its security and its solvency. You may want to think about:

• How much you keep on exchanges. Some users hold only what they plan to trade and keep the rest in their own wallet. Self-custody has its own risks, such as lost recovery phrases and phishing, so this is a decision to make with care.
• Not spreading everything on one platform.
• Reading the platform's official statements during an incident, rather than screenshots and forwarded messages.
• Understanding what proof-of-reserves reports do and do not show. They are snapshots, and they do not by themselves describe how keys are managed.
• Checking whether the firm is regulated where you live. Ask your national regulator or use your regulator's public register.

Scams that follow incidents

After a large incident, scammers often appear:

• Fake "compensation" or "recovery" messages pretending to come from the exchange.
• Fake support accounts offering to unlock withdrawals for a fee.
• Phishing pages that copy the exchange's login.
• Messages that ask you to move funds to a "safe" address.

Do not click links in unexpected messages. Use only the exchange's official app or website, which you reach by typing the address yourself or from a bookmark. Never share recovery phrases, passwords or one-time codes, and never pay a fee to receive your own funds back. Before you send funds to any address, you can check it with the free scanner on the ScamSonnar homepage. It is free and needs no sign-up.

What to do if you hold funds on the platform

Follow the exchange's official updates, avoid panic-driven actions such as sending funds to unfamiliar addresses and keep records of your balances and transactions. If you receive messages about the incident, assume they may be scams until you verify them on the official channels.

This situation is developing, and figures and details may change within hours. Verify the latest information from Mercado Bitcoin's official channels and from reliable news sources yourself.

This article is for general information only and is not financial advice.

Sources

• CoinDesk: Brazil's Mercado Bitcoin halts withdrawals after $40 million drained across 10 chains (2 November 2026)
• Decrypt: Brazil's Largest Exchange Mercado Bitcoin Halts Withdrawals After $40 Million Hack (2 November 2026)
• Mercado Bitcoin's official account on X (statements and destination addresses, as cited by both outlets above)
• Paolo Ardoino's account on X (Tether freeze announcement, as cited by both outlets above)

Both news articles rely on the same primary statements, so they are not independent confirmations of each other. Please read the primary sources yourself.