Mercado Bitcoin Security Review After November 2026 Wallet Drain Incident

Mercado Bitcoin security review focuses on the November 2, 2026, incident in which unauthorized transfers emptied hot wallets across multiple blockchains. The Brazilian exchange, founded more than 13 years ago and serving roughly 4.5 million users, detected the activity early that morning and paused deposits and withdrawals by midday UTC. No customer data breach occurred, and cold storage wallets remained untouched.

Analysts from several firms tracked the outflows. Hypernative estimated more than $40 million moved, Arkham placed the figure near $46 million, and Chainalysis reached approximately $49 million. Mercado Bitcoin later reported affected assets at around $38 million. The transfers involved plain signed transactions on Ethereum, Bitcoin, Solana, Tron, Polygon, Arbitrum, Avalanche, BSC, and Stellar, pointing to compromised signing keys rather than a smart-contract flaw.

Incident Timeline and Loss Estimates

The main outflows occurred between 06:19 and 06:53 UTC on November 2. Mercado Bitcoin announced containment measures at 12:56 UTC via its official X account and confirmed that customer balances stayed recorded on the platform. Subsequent updates on November 3 reiterated that the exchange would absorb the losses and that no user funds would be lost.

Loss estimates varied by source because different on-chain analytics tools applied slightly different valuation methods at the time of transfer. The following table summarizes reported figures:

Attacker-controlled addresses received assets including 2,852 ETH, 106 BTC, 10,700 SOL, and substantial amounts of USDT and USDC. Some customer deposit addresses on Ethereum were also drained, totaling roughly 35,853 ETH in one reported case. Mercado Bitcoin published the destination addresses publicly to aid tracking.

Recovery Efforts and Current Platform Status

Mercado Bitcoin coordinated with Tether, Circle, Paxos, BRL1, and Chainalysis to freeze stolen assets. By November 3, between $11 million and $12.9 million had been blocked. The exchange stated it maintains separation between hot and cold wallets and continues forensic work with law-enforcement agencies and security firms to determine how signing infrastructure was accessed.

As of November 3, 2026, deposits, withdrawals, and app access remain suspended. Some non-crypto platform components show operational status, but crypto services stay paused until security verification is complete. The exchange has not provided a reopening timeline and directs users to official channels only for updates.

Users checking “Is Mercado Bitcoin safe?” should note that the incident affected only hot wallets and that the company pledged to cover all losses. Cold storage, which holds the majority of client assets, stayed secure. Monitoring official announcements remains the recommended approach while tracing and recovery continue.