Mercado Bitcoin, Brazil’s largest crypto exchange, said on 2 November 2026 that it had quickly contained a security incident. Blockchain data tell a different story: transfers out of its customer deposit addresses continued for more than four hours after that message. This analysis examines the timing gap, the conflicting loss figures and the fund freezes.
🔑 Key takeaways
- On 2 November 2026, 36,042 customer deposit addresses were drained on Ethereum between 12:27 and 16:56 UTC.
- The ‘contained’ message went out at 12:56 UTC, 29 minutes after transfers began.
- Reported losses range from $38 million to $49 million, with no reconciled total.
- Frozen funds are estimated between $9 million and more than $15 million, with help from Tether and Circle.
- The breach is part of a wave of thefts, including Binance ($6.3 billion), Bitget ($388 million) and BitMart.
A timeline that contradicts the containment claim
According to Bitquery, the attacker drained 36,042 customer deposit addresses on Ethereum between 12:27 and 16:56 UTC on 2 November. Those addresses held roughly $266,000 in assets combined. Mercado Bitcoin’s containment message was published at 12:56 UTC, 29 minutes after transfers began and exactly four hours before the last recorded activity.
The full activity window therefore spans 4 hours and 29 minutes, or 269 minutes. Shattered, which performed the calculation from Bitquery data, derives an average of about 134 addresses touched per minute. In São Paulo, 12:56 UTC corresponded to 9:56 a.m., while the last recorded transfer occurred at 1:56 p.m. local time. The containment claim therefore came while outflows were still visible on-chain.
| Time (UTC) | Event | Source |
|---|---|---|
| 12:27 | Transfers begin from customer deposit addresses | Bitquery |
| 12:56 | Containment message published by Mercado Bitcoin | Statement |
| 16:56 | Last recorded on-chain activity | Bitquery |
This 4-hour, 29-minute gap sits at the heart of the criticism. Mercado Bitcoin has not repeated its containment language or explained the later transfers, and no independent confirmation was available for claims of zero customer losses or no data leak. CoinDesk reported that the platform was not immediately reachable for comment.
“We quickly contained a security incident in one of our systems early this morning.”
Mercado Bitcoin, social media statement, 2 November 2026
Loss estimates that do not converge
Estimates of the theft have never been unified. The table below lists the published figures, with their scope where it is known.
| Source | Figure | Scope |
|---|---|---|
| Mercado Bitcoin | about $38M | assets affected |
| Bloomberg (headline) | $40M | loss absorbed by the platform |
| Yahoo Finance | $46.3M | reported loss |
| Bitquery | $48.6M | assets stolen across 10 blockchains |
| Hypernative | more than $40M | suspicious transfers on at least 10 chains |
| Chainalysis | about $49M | funds taken across 17 blockchains |
According to Shattered, the gap between $38 million and $46.3 million reaches $8.3 million, roughly 22% of the lower figure. The sources offer no method for reconciling the 10-chain and 17-chain counts, or the $48.6 million and $49 million estimates. Differences may reflect which assets and transfers were counted, but neither the platform nor an independent auditor has published a definitive total.
The platform maintains that no customer lost money while promising to cover all user losses. A Bloomberg headline also says it will absorb a $40 million loss on its own accounts, but the exact link between that pledge and customer losses has not been published. The site was due to reopen in view-only mode on 9 November, with no date announced for resuming deposits and withdrawals.
Fund freezes with inconsistent totals
Chainalysis, which counts Mercado Bitcoin as a client, was alerted in the first hours of the incident. A platform director called Chainalysis’s local expert at 2:30 a.m. Eastern time and handed over a list of unauthorised transactions. Police were contacted within 30 minutes, and several stablecoin issuers were coordinated. Four million dollars in stablecoins had been blocked before the morning was over.
- Mercado Bitcoin: $11 million blocked with help from Tether, Circle, Paxos, BRL1 and Chainalysis.
- Chainalysis: about $9 million frozen, against an overall target of nearly $10 million.
- CoinDesk: more than $15 million frozen with partners including Tether, Circle and Chainalysis.
- Tether: more than $4 million of stolen USDT frozen after receiving the relevant addresses.
Shattered notes that the $11 million cited by the platform represents between 24% and 29% of the estimates ranging from $38 million to $46.3 million. The sources do not clarify whether these figures reflect different stages or different calculation scopes. Technically, stablecoins can be frozen at the contract level, whereas native bitcoin and solana assets cannot be frozen by a stablecoin issuer.
A possible link to BitMart
Bitquery’s investigation also connected the incident to another breach. An address controlled by the same attacker had begun receiving funds from wallets on Base, Arbitrum and Optimism before the Mercado Bitcoin hack. Bitquery attributes roughly $391,000 in losses to those wallets, a figure BitMart has not confirmed. Sheldon Xia, BitMart’s founder, acknowledged that his platform was also hacked on 2 November and said his preliminary inquiry pointed to the group behind the Mercado Bitcoin attack. The addresses overlap, but no shared infrastructure has been confirmed and the cause of both compromises remains unknown.
Binance, Lazarus and the wave of thefts
A few days earlier, Binance had reported a $6.3 billion loss, considered the largest in crypto history. The exchange says about half of the affected assets have been frozen, that many funds remain in the attackers’ hands, and that it will cover all losses. Its investigation first pointed to the compromise of an engineer’s laptop, which gave access to a service container from which unauthorised withdrawals were submitted.
“The attack did not simply use the permissions of a single engineer, and it was not a single action. It involved a more complex process. Our investigation has not attributed responsibility to any individual. So far, we have found no evidence of a wallet private key leak.”
Richard Teng, Co-CEO, Binance
Attribution and the North Korea link
Two analytics firms and Check Point attribute the attack to TraderTraitor, a North Korean unit also known as the Lazarus Group, which was already involved in the $1.5 billion Bybit theft in 2025. TRM Labs has identified several similarities with earlier North Korean incidents. Ari Redbord, TRM Labs’ global head of policy, called the event a “pivotal moment” and said recovery efforts are far from over. Binance has not directly answered questions about this link.
Check Point also linked the attack to the $388 million Bitget theft in September. In its assessment, attackers no longer need virtual vault keys and instead target the systems and authorised people who operate them. Tether and Circle together froze about $2.4 billion as part of the response to the Binance breach.
Market impact
The BBC reported a drop of more than 4% in bitcoin after the first alerts about Binance, along with a sharp decline in ether and solana. Yahoo Finance said bitcoin traded at $77,000 on 3 November, compared with more than $80,000 a week earlier. Binance withdrawals have been reported in two ways: nearly $11 billion in crypto and cash according to Yahoo Finance, and $4.7 billion in net withdrawals according to Shattered. The two figures have not been reconciled. Because Mercado Bitcoin is privately held, no share-price reaction was possible.
Outlook: transparency and scenarios
The Mercado Bitcoin case remains open. Three factors will shape how the episode is read: the publication of a reconciled loss figure, ideally verified by an independent auditor; the terms under which deposits and withdrawals resume after the announced 9 November reopening; and whether the links to BitMart and to the North Korean group cited in the Binance case are confirmed.
- Base case: a loss figure gradually refined within the $38 million to $49 million range, with customer compensation funded by the platform.
- Downside case: newly identified addresses widen the scope beyond $49 million, and user confidence remains durably impaired.
- Upside case: additional freezes, particularly of stablecoins, reduce the unrecovered share while prices stabilise.
These three scenarios are not forecasts. They do, however, underline that in a market already under pressure, operational security, not only the security of vaults, remains the main weak point for exchanges.
Sources
Cet article est publié à titre informatif et éducatif. Il ne constitue en aucun cas un conseil en investissement. Faites vos propres recherches (DYOR) avant toute décision.
