# Mercado Bitcoin hot wallets drained in a hack worth tens of millions; the exchange is offline and says customers will not lose assets · pwn.watch > Brazilian crypto exchange Mercado Bitcoin says it identified a security incident in the early hours of Nov 2 2026 that hit only its online hot wallets, not its offline cold wallets. It notified the authorities, suspended deposits and withdrawals and then took the platform temporarily offline, and says no customer data leaked and customers will not lose assets. In its Nov 2 evening update it said about US$11M had been blocked with help from Tether, Circle, BRL1, Paxos and Chainalysis, and about US$38M was still not blocked. Chainalysis, which helped trace and freeze funds, estimates about $49M was stolen across 17 blockchains, mostly Bitcoin and Ethereum. Crypto Times reports that Mercado Bitcoin later put the affected assets at about $36.3M with $12.9M blocked, and that it is preparing a gradual reopening with no confirmed date. The exchange has not said how the attacker got in. Page: https://pwn.watch/i/mercado-bitcoin-hot-wallet-hack-nov-2026 · generated 2026-11-04T21:45:17.355Z ## Status - Severity: high · status: live · patch: partial - Product: Mercado Bitcoin (crypto exchange hot wallets) - Started: 2026-11-02 - Affected: Mercado Bitcoin exchange hot wallets ## Follow this incident - RSS (one item per update): https://pwn.watch/i/mercado-bitcoin-hot-wallet-hack-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/mercado-bitcoin-hot-wallet-hack-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/mercado-bitcoin-hot-wallet-hack-nov-2026.json - This file: https://pwn.watch/i/mercado-bitcoin-hot-wallet-hack-nov-2026/llms.txt ## Updates (newest first) - 2026-11-04: Crypto Times reports that Mercado Bitcoin now puts the affected assets at about $36.3M with $12.9M blocked, and is preparing to restore platform access gradually as each function passes security checks, with no confirmed date. (https://www.cryptotimes.io/2026/11/04/mercado-bitcoin-plans-gradual-platform-reopening-after-36-3m-incident/) - 2026-11-04: Arkham reports that wallets linked to the attacker moved about $13.26M to 23 outside addresses and swapped stolen tokens for about $10.55M of ETH (4,605 ETH over 338 swaps), while a $650K bridge to Bitcoin through Bridgers appears to have been halted. (https://thedefiant.io/news/hacks/mercado-bitcoin-attacker-swaps-tokens-for-10-55-million-in-eth-arkham-says) - 2026-11-02: Mercado Bitcoin says it quickly identified and contained a security incident in one of its systems overnight, that customers suffered no losses and no data leaked, and that deposits and withdrawals are temporarily suspended as a precaution. (https://central.ajuda.mercadobitcoin.com.br/wiki/spaces/TF/pages/2965274628/9+56hs+09+11+2026+-+Atualiza+o) - 2026-11-02: Chainalysis says an attacker moved assets across 17 blockchains in waves, draining an estimated $49M, mostly Bitcoin and Ethereum, and that it helped law enforcement and stablecoin issuers freeze nearly $10M, including more than $4M of USDT frozen by Tether. (https://www.chainalysis.com/blog/chainalysis-response-mercado-bitcoin/) - 2026-11-02: In its evening update Mercado Bitcoin guarantees customers will not lose assets, says only its hot wallets were hit and the platform was taken offline, and puts the amount blocked at about US$11M with about US$38M not yet blocked. It warns it never asks for passwords, codes or recovery phrases and offers no refunds by link, WhatsApp or phone. (https://central.ajuda.mercadobitcoin.com.br/wiki/spaces/TF/pages/2965700610) ## Fix brief # Security brief: Mercado Bitcoin hot wallets drained in a hack worth tens of millions; the exchange is offline and says customers will not lose assets Source: https://pwn.watch/i/mercado-bitcoin-hot-wallet-hack-nov-2026 · status: live · severity: high · updated Nov 4, 2026, 19:10 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Brazilian crypto exchange Mercado Bitcoin says it identified a security incident in the early hours of Nov 2 2026 that hit only its online hot wallets, not its offline cold wallets. It notified the authorities, suspended deposits and withdrawals and then took the platform temporarily offline, and says no customer data leaked and customers will not lose assets. In its Nov 2 evening update it said about US$11M had been blocked with help from Tether, Circle, BRL1, Paxos and Chainalysis, and about US$38M was still not blocked. Chainalysis, which helped trace and freeze funds, estimates about $49M was stolen across 17 blockchains, mostly Bitcoin and Ethereum. Crypto Times reports that Mercado Bitcoin later put the affected assets at about $36.3M with $12.9M blocked, and that it is preparing a gradual reopening with no confirmed date. The exchange has not said how the attacker got in. Severity detail: Tens of millions of dollars drained from the exchange's hot wallets (estimates range from about $36M to $49M); Mercado Bitcoin says it will cover the loss and customer data was not exposed, but the platform remains offline - Product: Mercado Bitcoin (crypto exchange hot wallets) ## Affected versions - Mercado Bitcoin exchange hot wallets ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Loss figures differ: Chainalysis ~$49M across 17 chains; CoinDesk ~$38-40M across at least 10 chains with $11M frozen; MB's Nov 2 21:00 update ~US$11M blocked and ~US$38M not blocked; Crypto Times (citing MB's X thread) $36.3M affected, $12.9M blocked. Arkham (Nov 4) says hop wallets sold ~$10.55M of alts for ETH and a $650K Bridgers bridge to BTC appears halted (cited via The Defiant). Re-check MB's help center and @MercadoBitcoin for reopening, root cause and final totals; set patchStatus patched once the platform is back and MB says it is secured. ## Latest updates - Nov 4, 2026: Crypto Times reports that Mercado Bitcoin now puts the affected assets at about $36.3M with $12.9M blocked, and is preparing to restore platform access gradually as each function passes security checks, with no confirmed date. - Nov 4, 2026: Arkham reports that wallets linked to the attacker moved about $13.26M to 23 outside addresses and swapped stolen tokens for about $10.55M of ETH (4,605 ETH over 338 swaps), while a $650K bridge to Bitcoin through Bridgers appears to have been halted. - Nov 2, 2026: Mercado Bitcoin says it quickly identified and contained a security incident in one of its systems overnight, that customers suffered no losses and no data leaked, and that deposits and withdrawals are temporarily suspended as a precaution. - Nov 2, 2026: Chainalysis says an attacker moved assets across 17 blockchains in waves, draining an estimated $49M, mostly Bitcoin and Ethereum, and that it helped law enforcement and stablecoin issuers freeze nearly $10M, including more than $4M of USDT frozen by Tether. - Nov 2, 2026: In its evening update Mercado Bitcoin guarantees customers will not lose assets, says only its hot wallets were hit and the platform was taken offline, and puts the amount blocked at about US$11M with about US$38M not yet blocked. It warns it never asks for passwords, codes or recovery phrases and offers no refunds by link, WhatsApp or phone. ## Advisories - [21:00hs 02/11/2026 - Atualização](https://central.ajuda.mercadobitcoin.com.br/wiki/spaces/TF/pages/2965700610) (Mercado Bitcoin) - [9:56hs 02/11/2026 - Atualização](https://central.ajuda.mercadobitcoin.com.br/wiki/spaces/TF/pages/2965274628/9+56hs+09+11+2026+-+Atualiza+o) (Mercado Bitcoin) ## Write-ups & news - [Disrupting the Mercado Bitcoin Attack: How Chainalysis Led the Freeze of Nearly $10M in Stolen Funds](https://www.chainalysis.com/blog/chainalysis-response-mercado-bitcoin/) - [Mercado Bitcoin pledges to cover all user losses after near $40 million hack](https://www.coindesk.com/business/2026/11/03/mercado-bitcoin-pledges-to-cover-all-user-losses-after-near-usd40-million-hack) - [Mercado Bitcoin Plans Gradual Platform Reopening After $36.3M Incident](https://www.cryptotimes.io/2026/11/04/mercado-bitcoin-plans-gradual-platform-reopening-after-36-3m-incident/) - [Mercado Bitcoin Attacker Swaps Tokens for $10.55 Million in ETH, Arkham Says](https://thedefiant.io/news/hacks/mercado-bitcoin-attacker-swaps-tokens-for-10-55-million-in-eth-arkham-says) ## Caveats Mercado Bitcoin customers have nothing to patch. Wait for the exchange's own announcements about reopening, and ignore anyone offering refunds or asking for passwords, codes or recovery phrases. --- Machine-readable: https://pwn.watch/i/mercado-bitcoin-hot-wallet-hack-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.