The Mercado Bitcoin Hack (Nov 2026): What We Know, What We Don't, and What Communities Should Do

By Sam Giri · 2 November 2026

Developing story. Written on 2 November 2026 from public reports. Figures differ between sources and will change. Not financial advice.

On 2 November 2026, Mercado Bitcoin (MB), described by several outlets as Brazil's largest crypto exchange, confirmed a security incident and paused deposits and withdrawals. Blockchain security firm Hypernative flagged more than $40 million in suspicious transfers. Here is a careful summary and what it means if you run or join a Web3 community.

Not to be confused with the 2025 attack on C&M Software, a Brazilian banking-infrastructure provider. That was a different incident.

What is confirmed

• MB confirmed unauthorised access to one of its systems on 2 November, announced on its official X account.
• MB temporarily suspended deposits and withdrawals as a precaution.
• MB says it contained the incident quickly, that no customer data was leaked, and that customers will not incur losses.

What is reported but not confirmed by MB

• Amount. Hypernative's preliminary analysis flags more than $40 million in suspicious transfers. MB has not confirmed this figure or whether customer funds were involved. Some Brazilian outlets cite estimates around R$217 million, from unnamed sources.
• Scope. Hypernative reports outflows across at least 10 blockchains, including Bitcoin, Ethereum, Solana and Tron. It lists the attacker's holdings as roughly 106 BTC, 2,852 ETH, 10,700 SOL and 6.7 million XLM, plus other tokens.
• Timing. Activity reportedly began around 02:15 UTC, which is 23:15 on Sunday 1 November in Brasília.
• Freezes. BitNotícias reports that Tether froze about $3.7 million linked to the attack. Treat this as an early figure.
• Cause and attribution. MB has not published a root cause. No credible attribution to any group has been confirmed. Do not repeat guesses as fact.

Why it matters beyond one exchange

1. A pause is a trust moment. When an exchange freezes withdrawals, its community fills with questions within minutes. Silence is read as risk.
2. "Your funds are safe" is a claim, not a proof. Members will wait for reconciliation: what left, from which wallets, and who covers it.
3. Multi-chain exposure is harder to contain. Ten networks means ten places to monitor, freeze and trace.
4. Scammers move fast. Fake "withdrawal reopened", "compensation" and "claim" links appear within hours of any incident.

What community managers should do this week

• Post an official statement early and keep it short. What you know, what you don't, and when the next update comes.
• Warn about scams. The team will never DM first and will never ask for seed phrases. Official links only.
• Separate facts from opinion. Label confirmed items, reported items and speculation.
• Don't give price calls or financial advice. Keep the community calm without telling anyone what to buy or sell.
• Test your own bad-day plan. See Trust Is the Product and What 1M+ Members Taught Me.

If you want a second pair of eyes on your incident-response plan for a community, you can book a short call at cal.com/samgiri/intro.

Sources (public reporting, 2 Nov 2026)

• Crypto Briefing: Mercado Bitcoin freezes deposits and withdrawals after security incident
• Cryptonomist: Over $40M in suspicious transfers flagged after Mercado Bitcoin cyberattack
• SpaceMoney: Mercado Bitcoin confirma ataque hacker e suspende operações
• BitNotícias: Tether bloqueia US$ 3,7 milhões do ataque hacker na exchange Mercado Bitcoin
• Livecoins: Mercado Bitcoin confirma ataque hacker e trava saques e depósitos

Sam Giri is a Web3 community builder and founder working across Web3, FinTech and PropTech. This article is general information based on public reports and is not financial or legal advice.