According to Telegram relays of its statements, Mercado Bitcoin, a Brazilian exchange, had a security incident on 2 November 2026 and paused deposits and withdrawals. This Mercado Bitcoin hack is one of two exchange incidents in a week, after Binance reported a far larger one on 29 October. Below we set the two side by side: what was hit, how much, what was frozen and what users were told.
Mercado Bitcoin’s own pages were not open to us when we wrote this (one returned an access error). The figures below come from Telegram news relays seen in Brandefense Blackhole, so each is attributed and may change. Binance’s figures come from our earlier Binance post, which cites Binance’s own reports.
Mercado Bitcoin and Binance Side by Side
Read each row as a claim with a source, not as a verdict. The Mercado Bitcoin column is relayed and early; the Binance column is Binance’s initial report of 3 November 2026 as summarised in our post. The last column is our reading, and it is labelled as ours.
| Point | Mercado Bitcoin (2 November, relayed) | Binance (29 October, Binance's report) |
|---|---|---|
| What was hit | Hot wallets, according to relays; the relays list about 10 blockchains | Hot wallets, per Binance’s initial report, through an internal wallet signing service |
| Amount affected | About $36.3M in the latest relayed update; earlier relays said over $40M and about $38M | About $6.34B, per Binance, with reconciliation still to come |
| Frozen or blocked | About $12.9M in the latest relay; the $38M relay said $11M, with help from Tether, Circle and others | About $2.85B frozen or intercepted, per Binance |
| User impact | Deposits and withdrawals paused; the exchange says customers will not lose assets | Withdrawals paused; Binance says it will cover losses and reports about 95% of the impacted amount covered |
| Cause stated | The exchange’s statement, as relayed, gives no method; some relays speculate, which we do not repeat | Binance’s report describes a months-long chain and says the FBI attributes it to North Korea |
| Scale gap (our reading) | The affected sum is under 1% of the Binance figure | Roughly 175 times larger than the latest relayed Mercado Bitcoin figure (our arithmetic: 6.34B / 36.3M) |
How to read the table: the gap in size is large. Both cases hit hot wallets, and both met a pause and a statement that customers are covered, according to the relays for Mercado Bitcoin and per Binance’s report for Binance. What is known differs as much as the money, since Binance has published a causal chain and the relays have not. Our reading: Mercado Bitcoin is where Binance was in its first days.
How the Mercado Bitcoin Number Moved in One Day
In Brandefense Blackhole, 47 Telegram posts from 42 channels created between 13:54 UTC on 2 November and the evening of 3 November mention the exchange by name. Of these, 20 were created on 2 November and 27 on 3 November. A name search for “Mercado” alone is noisy, so we count only posts containing “Mercado Bitcoin”.
| Time | What the relay said | Posts in our set |
|---|---|---|
| 2 Nov, from 14:21 | Over $40M in suspicious transfers across at least 10 blockchains, attributed in one relay to analysts at Hypernative; the exchange had not confirmed it as customer loss | about 30 posts carry a figure of about $40M |
| 2 Nov, 22:30 | One relay adds an on-chain estimate of $48.5M, and says related stablecoins were reportedly frozen | 1 post |
| 3 Nov, from 04:13 | Losses “over $46M”, described as an update to on-chain tracking | 16 posts, many near-identical copies |
| 3 Nov, 13:07 | About $38M affected, $11M already blocked with help from Tether, Circle and others | 1 post |
| 3 Nov, 17:26 | About $36.3M affected and $12.9M blocked or frozen, described as the exchange’s update | 1 post |
The posts that carried the first figure were mostly quick relays of one source, and the 46M copies repeat one text. Our reading: the two latest relayed figures are the ones described as the exchange’s own updates, so we weight them above the earlier outside estimates of suspicious transfers. All of them remain relayed and may change.
What Was Frozen, and by Whom
An early relay on 2 November said Tether had frozen 4.5 million USDT linked to the incident. Later relays said the exchange worked with stablecoin issuers and others to block funds, with the $11M and $12.9M figures above. The issuers’ own statements were not open to us, so the split by company is not ours to give.
For Binance, our post reports that about $2.85B of $6.34B was frozen or intercepted at the time of Binance’s report, per Binance. The shares differ by less than the sums do. Roughly a third of the affected sum was frozen in the Mercado Bitcoin relay and under half in the Binance report, but the bases differ. That is our arithmetic on the reported numbers and is not a finding.
What This Means for Exchange Teams
This section is our advice, not a finding from the sources. Both incidents point at the same weak spot: the hot wallet and the systems that sign for it. For supplier access as an entry route, see our Bybit post on supplier access.
- Keep hot wallets smallHold only what daily withdrawals need, and move the rest to cold storage with separate approvals.
- Watch the signing pathAlert on any new delegation or signer change on a hot wallet, because Binance’s report describes this route.
- Prepare freeze contactsKeep working contacts at stablecoin issuers and analytics firms, since freezes are the part of the response the relays describe.
- Publish one numberGive a single dated figure with its basis, so that relays stop passing on outside estimates.
- Warn your usersTell customers that support will not ask for seed phrases or logins after an incident, and watch for fake recovery pages.
For what the Binance case showed in detail, read our Binance security investigation page. For how fast guesses spread after that incident, see our Binance hack on Telegram and X analysis.
What Stays Open
The method and the attacker are not stated in the exchange’s statement as relayed; some relays speculate, and we do not repeat that. The Mercado Bitcoin figures may change again, and we did not open the exchange’s own statement. We recommend treating the latest relayed figure as provisional until the exchange or the issuers publish more.