Mercado Bitcoin Suffers Cyberattack as Researchers Flag $40 Million in Suspicious Crypto Transfers

Brazilian cryptocurrency exchange Mercado Bitcoin suspended deposits and withdrawals on November 2, 2026, after detecting a security incident in one of its systems.

Blockchain security firm Hypernative flagged more than $40 million in suspicious transfers across at least 10 blockchains, raising questions about the scope of the breach. The exchange has not confirmed that amount as its actual loss.

In its official statement, Mercado Bitcoin said it quickly contained the incident early Monday morning. The company said customers suffered no harm and no data leaked. It described the service suspension as a protective measure while its teams investigate, trace assets, and work with authorities.

According to reports, Opsek founder Pablo Sabbatella shared findings describing transfers from wallets linked to Mercado Bitcoin into fresh addresses. The affected networks included Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain and Stellar. Researchers said the activity covered at least 10 chains in total.

Mercado Bitcoin Suffers Cyberattack

Most of the reported outflows occurred between 06:19 and 06:53 UTC, a 34-minute window. Earlier Bitcoin activity reportedly began around 02:15 UTC, when funds from deposit addresses started moving to addresses linked to the suspected attacker.

The preliminary count included approximately 2,852 ETH, 106 BTC, 10,700 SOL and 6.7 million XLM, alongside more than 200 other tokens. These figures remain researcher estimates rather than amounts verified publicly by Mercado Bitcoin.

Researchers described the movements as ordinary transfers rather than a smart contract exploit. That distinction puts attention on how the transactions received valid signatures. However, the available findings do not establish how the attacker obtained signing access or which internal system was compromised.

The incident follows other exchange wallet breaches covered by Cybersecurity News, including the Bitget hot wallet hack. That case involved unauthorized transfers affecting hot and warm wallet infrastructure. It offers industry context, but does not establish a shared attack method or attacker in the Mercado Bitcoin incident.

Mercado Bitcoin later published destination addresses covering Ethereum-compatible networks, Bitcoin, Solana, Stellar and Tron. The exchange said it released them to help identify and track funds on public blockchains. Such tracking also featured in the Bitfinex hack investigation, which documented how investigators followed stolen cryptocurrency through laundering activity.

As Bitcoin Magazine reported, Mercado Bitcoin had not announced a reopening time or disclosed the affected system. The unresolved issue remains the gap between suspicious wallet movements and confirmed losses. Its statement that customers were unharmed should not be read as confirmation that no exchange assets were taken.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Mercado Bitcoin Suffers Cyberattack as Researchers Flag $40 Million in Suspicious Crypto Transfers appeared first on Cyber Security News.