Mercado Bitcoin Multi-Chain Hot-Wallet Breach

On November 2, 2026, Mercado Bitcoin — Brazil's largest crypto exchange — had its hot wallets drained across ten blockchains for approximately $46 million. There was no smart-contract bug and no oracle to manipulate: every outgoing transaction was an ordinary native transfer carrying a valid signature, the signature of an attacker who had somehow gained the ability to move the exchange's own funds.

What happened

Between roughly 06:24 and 06:50 UTC, in a window of about 25 minutes, the exchange's hot wallets on Ethereum, Bitcoin, Solana, Tron, Stellar, Polygon, Arbitrum, Avalanche, XDC and BNB Chain paid out to a single cluster of attacker-controlled addresses. Bitquery, which reconstructed the drain on-chain, valued the loss at about $48.5 million (or $47.2 million excluding an illiquid Arbitrum token), with Ethereum accounting for roughly $29.5 million and Bitcoin about $8.3 million; the exchange publicly confirmed suspected outflows above $46 million, while Hypernative's preliminary estimate had been above $40 million. From about 12:10 UTC the attacker went further, signing transfers that began emptying tens of thousands of individual customer deposit addresses. Mercado Bitcoin said it found no evidence that wallet private keys had been exposed, yet the attacker was able to initiate transfers through a compromised internal environment — a pattern analysts read as a signing-infrastructure or key compromise rather than a protocol flaw.

Aftermath

The exchange halted withdrawals and opened an investigation, stating that no customer would lose money and that losses would be absorbed by the company. Stablecoin issuers moved quickly: Tether and Paxos together froze about $7.3 million — roughly 15% of the haul — across USDT, USDT0, PAXG and other tokens on several chains, while Circle had frozen nothing as of the last public check, leaving around $4.29 million in USDC and EURC free to move. Most of the stolen value had not been laundered at the time of reporting; on Ethereum alone about $19.5 million was shuffled into ten fresh wallets. Mercado Bitcoin had not identified the attackers or disclosed how the intrusion began.

Why it matters

The Mercado Bitcoin breach is a textbook centralized-exchange key-and-signing compromise: once an attacker controls the machinery that signs withdrawals, the blockchain faithfully executes every theft as a legitimate transaction. It landed days after the record $6.3 billion Binance theft, underscoring that operational security — not clever contract exploits — remains the dominant failure mode for custodians, echoing earlier hot-wallet disasters. The speed of the cross-chain payout, draining ten networks in under half an hour, also shows why issuer freezes can only ever recover a slice: by the time humans react, the funds are already dispersed.