In the early hours of 2 November 2026 Mercado Bitcoin, Brazil’s largest crypto exchange, identified a security incident and took the platform offline. The company’s help note at 21:00 in Brazil, which is 00:00 UTC on 3 November, says customers will not lose assets. Only the hot wallets were hit. Those are the online wallets the exchange uses for ordinary deposits and withdrawals. The company compares them to a shop’s till. The larger holding, the cold wallets, it compares to a vault, and it says the vault was not reached. About $11 million has been blocked, with help from Tether, Circle, BRL1, Paxos, and Chainalysis. About $38 million has not. This page will not describe how the hot wallets were signed, and it will not publish the destination addresses the company gave to tracers.
Mercado Bitcoin is an exchange. The number in the app is a claim on the company. An exchange balance is an IOU, not a wallet. The coins that can leave quickly sit in the till. When that till is swept, the screen can still show yesterday’s balance. What changed is whether the coins behind the screen are still in a wallet the company can spend. The promise in the help note is that the customer will not be the one who absorbs that gap. The note does not name a fund, a date, or whether the make-whole is in crypto or in reais.
What happened
The company says it triggered its governance protocols, notified the authorities, and took the platform down as soon as the incident was found. The 21:00 note is the accounting. The blocked slice is about $11 million. The slice still not blocked is about $38 million. Add them and the incident is about $49 million, which is also the gross figure Chainalysis published from its own tracing. Those are not two thefts. Chainalysis described the movement as about $49 million across 17 chains, and its own freeze tally was near $10 million. A CoinDesk account said at least 10 chains. Mercado Bitcoin’s help note does not publish a chain count. Use the company’s two dollar figures. Do not add a tracker’s total on top of them.
The same note says other amounts that could still be blocked have been identified, and that the work continues. A block is a token an issuer or a venue can stop. It is not a coin returned to the till, and it is not a payment to a customer. Bitcoin does not have that switch. A frozen stablecoin is stuck. It is stuck somewhere other than the customer’s withdrawal.
CoinDesk reported the exchange as saying no customer data leaked. The help note this page is using does not repeat that sentence. It does say the platform comes back only when Mercado Bitcoin is sure the operation is safe for the customer, and that the time will be announced on the app, the site, and the company’s own Instagram and X accounts. It does not give that time. An automated status page marked the website, the app, login, and the trade API operational at 19:32 UTC on 2 November. That mark is earlier than the 21:00 note, and the page says the mark was written by a monitor. A green widget is not the company’s restart.
The note’s scam warning is specific. Mercado Bitcoin says it never asks for a password, a verification code, or a recovery phrase, and that it does not offer refunds by a link, by WhatsApp, or by a phone call. A message that does any of those is not the help note. See A practical checklist for keeping crypto safer.
Why it matters
If your coins are on Mercado Bitcoin, you are a creditor of Mercado Bitcoin for that number, for as long as they stay there, and for as long as the platform is the only door out. The promise is the company’s. It is not a chain reversing the transfers, and it is not a government deposit scheme. If your coins are in a wallet whose keys you hold, and you only ever sent a deposit, this incident did not spend that wallet. See How crypto wallets actually work.
This is the same shape as two other exchange tills on this site, and it is not those incidents. Binance puts the hot-wallet loss near $6.3 billion. Bitget lost about $387.5 million from hot wallets. Each time the online float moved and the company said the customer ledger would be honoured. The amounts are not comparable. The product is. Nobody who can restore a Mercado Bitcoin balance needs a phrase, and nobody needs you to send coins to an address a message just produced.
What happens next
A restart, on the channels the help note named, and only when the company says the platform is safe. More of the $38 million blocked, if the issuers and the venues agree. A named source for the customer promise, which the note does not yet give. A technical account, which is not this note, and which this page will not supply. Watch the help centre and the company’s own accounts. We will not treat $11 million blocked as $49 million recovered, and we will not treat a status widget as the door reopening.
Not a recommendation to deposit, withdraw, or close a Mercado Bitcoin account. Not a finding that any other Brazilian exchange was hit. Not a description of the access. The company’s own account, on the evening of 2 November, was a till, a vault that was not touched, two dollar figures, and a promise that the customer will not be the one who pays.
