Mercado Bitcoin Halts Deposits and Withdrawals After Cyberattack as $40 Million in Suspicious Transfers Emerge

Brazilian cryptocurrency exchange Mercado Bitcoin suspended deposits and withdrawals on November 2, 2026, after detecting a security incident affecting one of its internal systems. The disruption coincided with blockchain security firm Hypernative reporting more than $40 million in suspicious transfers spanning at least 10 blockchains — a figure the exchange has so far declined to confirm.

What Happened

According to reporting by Cyber Security News, Mercado Bitcoin moved quickly to restrict inbound and outbound transfers once the incident was identified. Suspending deposits and withdrawals is a standard containment measure for exchanges under attack: it limits further exposure, slows the movement of assets, and buys incident responders time to assess which wallets and systems may have been touched.

The exchange characterized the event as a security incident in one of its systems and has not publicly confirmed the scale of any losses. That gap between the platform's cautious language and Hypernative's on-chain observations is the central open question. Hypernative, which specializes in real-time threat detection across blockchain networks, flagged the transfers across at least 10 chains — a detail that suggests activity extending well beyond a single wallet or network.

Why the Multi-Chain Detail Matters

A suspicious transfer on one blockchain can often be explained by routine treasury movements, internal rebalancing, or a compromised hot wallet. Activity spread across ten or more chains is harder to dismiss. It points toward one of several possibilities: compromised private keys controlling omnichain infrastructure, a breach of internal systems used to orchestrate transfers, or attacker-controlled wallets receiving funds routed through cross-chain bridges.

Importantly, suspicious transfers are not the same as confirmed theft. On-chain analytics firms flag anomalous patterns, and some of those patterns later turn out to be legitimate operational activity. Until Mercado Bitcoin publishes its own accounting — or independent investigators corroborate the figure — the $40 million should be treated as an unverified estimate rather than a confirmed loss.

The Broader Pattern for Crypto Exchanges

Mercado Bitcoin is one of the largest crypto platforms in Latin America, which makes the incident significant beyond Brazil. Exchanges sit at the intersection of high-value assets and internet-facing infrastructure, and they have been a persistent target for financially motivated intrusion sets for years. The typical attack paths are well documented: credential theft and social engineering against employees, compromise of signing infrastructure, vulnerabilities in third-party integrations, and insider involvement.

The containment playbook seen here is familiar and, from a security standpoint, sound in its early stages. Freezing withdrawals, isolating affected systems, engaging external forensic support, and communicating through official channels are all appropriate first moves. What matters next is transparency: affected users need clear guidance on whether funds are safe, what data or assets may have been exposed, and what timeline to expect for restored services.

What Users and Defenders Should Watch

For customers of the exchange, the practical advice is straightforward. Treat unsolicited messages claiming to offer refunds, recovery services, or "verification" of accounts as likely phishing — attackers routinely exploit exchange incidents to harvest credentials. Rely only on official status updates, and enable strong multi-factor authentication where account access remains available.

For security teams at financial and crypto organizations, the incident reinforces several durable lessons:

• Assume key compromise is possible. Detection and rapid revocation of signing authority should be rehearsed, not improvised.
• Monitor on-chain activity as a security control. Third-party blockchain monitoring can surface anomalies before internal telemetry does, especially when assets move across multiple networks.
• Have a pre-approved containment plan. The decision to halt withdrawals is high-stakes and time-sensitive; it should be documented and authorized in advance.
• Prepare disclosure processes. Regulatory obligations and customer trust both hinge on timely, accurate communication.

The Road Ahead

Mercado Bitcoin has not disclosed a root cause, a confirmed loss figure, or a timeline for restoring full service. Until it does, the incident remains a developing story. The key questions are whether the flagged transfers are connected to the intrusion, how the attackers gained access, and whether customer funds were affected.

What is already clear is the recurring theme: crypto exchanges remain high-value targets, and the window between initial compromise and irreversible asset movement can be measured in minutes. Organizations that pair strong key management with continuous blockchain monitoring and a rehearsed incident response plan will be better positioned to limit damage when — not if — the next incident occurs.

Original reporting: Cyber Security News — Mercado Bitcoin Suffers Cyberattack