Mercado Bitcoin halts deposits and withdrawals after reported $40 million security incident

Mercado Bitcoin, Brazil’s largest domestic cryptocurrency exchange, suspended deposits and withdrawals after a security incident that blockchain security firm Hypernative says may have affected more than $40 million in digital assets. For PSPs and exchanges, the useful part here is not the headline number; it is the operational response: freeze first, investigate second, and only then try to map what actually moved.

1. Hypernative first flagged suspicious activity on November 2, after identifying transfers from wallets attributed to Mercado Bitcoin to newly created addresses across multiple blockchain networks. The firm estimated that more than $40 million worth of assets may have been affected.
2. Mercado Bitcoin later acknowledged the incident in an official update and said deposits and withdrawals had been temporarily suspended while its teams investigated the breach. The exchange said customer funds remain safe, and that the exact value of the assets lost has not yet been independently confirmed by Mercado Bitcoin.
3. The exchange said customer assets remain protected and that its teams are working to determine the full scope of the incident. At the time of publication, Mercado Bitcoin had not publicly confirmed the approximately $40 million loss estimate cited by blockchain security researchers.
4. Hypernative said the transactions appeared to be ordinary signed cryptocurrency transfers, not transactions exploiting a smart contract vulnerability. That leaves the obvious uncomfortable question: how did someone get the ability to authorize transfers from the affected wallets?
5. Mercado Bitcoin has not yet disclosed the technical cause of the incident. The possible attack surface, based on the information available so far, includes private keys, internal signing infrastructure, employee credentials, or another part of the exchange’s systems.

The incident came just days after the record $6.3 billion Binance hack, which is why centralized exchange security is back under a harsh light. For high-risk payment teams, the lesson is straightforward: if your flow touches crypto exchange infrastructure, wallet controls and incident response are not abstract governance items, they are core operational risk.