Skip to content
Blockchain Posts

exploit

Mercado Bitcoin halts withdrawals after suspicious transfers across ten chains

Hypernative flags $40M+ in outbound transfers across ≥10 chains on Nov 2; Tether freezes 4.5M USDT, no smart-contract exploit, signing-key compromise suspected.

by 4 min read
exploitethereumbitcoinsolanatron

Brazil's largest crypto exchange Mercado Bitcoin suspended deposits and withdrawals on Monday, November 2, 2026 after Web3 security firm Hypernative flagged more than $40 million in suspicious outbound transfers across at least ten blockchains. Tether CEO Paolo Ardoino confirmed Tether froze more than 4.5 million USDT tied to the incident. Primary sources: CoinDesk, Decrypt. The exchange has published destination addresses on EVM chains, Bitcoin, Solana, Stellar and Tron but has not yet confirmed any figure or disclosed the entry point.

What happened

Mercado Bitcoin's own statement, posted to X and relayed in both English-language write-ups, says the exchange "identified and swiftly contained" a security incident on one of its systems and has "temporarily suspended" deposits and withdrawals as a precaution. The exchange states that no customer lost money and no data leaked; the on-chain figures are not confirmed by the company.

Hypernative's figure is more than $40 million in suspicious transfers. Opsek founder Pablo Sabbatella, cited by CoinDesk, puts the attacker's holdings at roughly 2,852 ETH, 106 BTC, 10,700 SOL, 6.7 million XLM and 77,000 AVAX, plus more than 200 other tokens. CoinDesk names the chains touched as Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC and Stellar, plus other chains not specified; Decrypt names Bitcoin, Ethereum, Solana and Tron. Both reports agree on at least ten chains in total.

The largest outflows occurred, per Opsek, between 06:19 and 06:53 UTC. Mercado Bitcoin reportedly published destination addresses on EVM chains, Bitcoin, Solana, Stellar and Tron about 90 minutes after its statement so other platforms could trace funds; neither primary report reproduces those addresses, and we are not reproducing addresses or tx hashes we have not independently seen.

Mechanism — ordinary transfers signed with legitimate keys

Per Opsek's analysis, cited by CoinDesk, the outflows were plain transactions signed with the platform's legitimate private keys — not a smart-contract exploit. How the attacker obtained signing access is unknown. That matches the Hypernative framing: the attacker is spending from Mercado Bitcoin's own wallets, not pulling value out of a vulnerable contract.

That shape — multi-chain sweeps from a single platform's hot wallets inside a tight time window — is the same operational signature that defined the October 29 Binance compromise, which the FBI attributed to North Korea's TraderTraitor group. Neither Mercado Bitcoin nor the covering outlets have linked the two incidents on-chain, and no actor has claimed responsibility.

Impact and freezes

  • Tether (USDT): Paolo Ardoino, Tether CEO, said: "Tether froze more than 4.5M USDT related to this security incident."
  • Mercado Bitcoin service: deposits and withdrawals paused, no resumption date given.
  • User funds: the exchange states no customer harm; the on-chain claim total remains the attacker's post-sweep holding, not a confirmed Mercado Bitcoin loss figure.

Numbers block, per Opsek's reporting (not confirmed by Mercado Bitcoin):

  • Suspicious outbound total: more than $40M
  • Chains touched: ≥ 10 (ETH, SOL, TRON, BTC, XLM, AVAX, Polygon, Arbitrum, BSC, plus others)
  • Attacker ETH holding: ~2,852 ETH
  • Attacker BTC holding: ~106 BTC
  • Attacker SOL holding: ~10,700 SOL
  • Attacker XLM holding: ~6.7M XLM
  • Attacker AVAX holding: ~77,000 AVAX
  • Tether USDT frozen: >4.5M USDT

What to watch

  1. Mercado Bitcoin's post-mortem: entry point (private-key compromise vs. infrastructure breach), hot-wallet architecture, custody split with any cold-storage insurer.
  2. Addresses the exchange publishes: once the exchange releases destination addresses, other venues can match them against inbound deposits and freeze on sight.
  3. Freezes beyond Tether: Circle (USDC), stablecoin issuers, exchanges with on-chain analytics teams. The 24 hours after the public address list are the window where custodial funds still sit at the attacker's address.
  4. Resumption date: Mercado Bitcoin has not given one.
  5. Any FBI, CISA or Brazilian federal police attribution: at the time of writing, there is none, and we will not pre-attribute without one.

Context — the pattern on exchange hot-wallet compromises

Five days after the $6.3 billion Binance compromise, a second major exchange sees its hot wallets swept inside a 34-minute window with no smart-contract exploit. In both cases the attacker is spending from the platform's own signing keys, not breaking a contract or governance mechanism. Hot-wallet signing-key custody — the operational link between an exchange's internal admin stack and its on-chain spending authority — is now the exposed surface the two biggest incidents of the fall have in common. Our prior Binance coverage is on this site; the Mercado Bitcoin triage will tell whether this is the same adversary or a copycat with the same operational template.

Related stories