On Wednesday, November 4, 2026, The Paypers reported that Brazilian cryptocurrency exchange Mercado Bitcoin (MB) suspended customer deposits and withdrawals following a security incident affecting one of its systems.
The exchange said it detected and contained the incident quickly. It stated that clients suffered no losses and that no data was leaked. MB has not said when deposits and withdrawals will resume.
Blockchain security firm Hypernative estimated that wallets attributed to MB lost about $40 million. The firm said the movements spanned at least ten blockchains, including Bitcoin, Ethereum, Solana and Tron. The first suspicious transfers appeared around 11 p.m. Brazil time, and most of the funds went to newly created addresses tied to the suspected attacker.
According to Hypernative, the transfers were standard transactions
According to Hypernative, the transfers were standard transactions signed as though the wallets’ owners had approved them, rather than exploits of smart contract flaws. The firm said it is unclear how the attacker gained the ability to sign them. It cited exposed private keys or a failure in the systems that authorise transfers as possible explanations. MB’s statement does not directly connect the incident to the wallet movements.
MB said its teams are investigating, tracing the assets and working with authorities. In a later update, the exchange said it had blocked $11.2 million in assets with help from industry firms and organisations. It also shared destination addresses so others can monitor activity across blockchain networks. MB pledged to provide regular updates.
Several questions remain unanswered, including how the incident began, the final amount lost, and whether the funds belonged to customers or to the exchange. Founded in 2013, MB runs one of Brazil’s main crypto trading platforms. It reminded customers that it never requests passwords, verification codes, or recovery phrases.
The incident follows a separate security incident at Binance in late October 2026.
