In roughly 25 minutes, during the early hours of November 2, Mercado Bitcoin's operational wallets sent funds to an unknown address across ten separate blockchains. Brazil's largest crypto exchange confirmed the attack that same morning, suspending deposits and withdrawals while claiming no customer data was compromised. The exchange has not disclosed the amount stolen. Third-party estimates range from over $40 million, per Hypernative's initial assessment, to $48.5 million according to Bitquery's on-chain investigation.
Gaurav Agarwal
This reconstruction draws on Bitquery's on-chain investigation, Arkham's analysis, and reporting by The Record, Cointelegraph, and Bitcoin Magazine. For Mercado Bitcoin's official statements, we rely on texts reported by InfoMoney, CNN Brasil, and Exame. The Banco Central regulatory background comes from Capital Aberto. Mercado Bitcoin's posts on X and a Bloomberg article were inaccessible with our tools and are cited through outlets that reproduced them. All timestamps are in UTC.
Phase 1: Reconnaissance and the Drain
According to Arkham, the attacker ran a first test transaction on Base at 01:22 UTC. Dickson Wu of CertiK, quoted by Cointelegraph, wrote that the attacker spent roughly four hours probing eight smaller networks, including Base, Optimism, and Arbitrum. Bitquery places a separate withdrawal of approximately $298,000 on those networks, initiated 53 minutes before the main outflow from Mercado Bitcoin began.
Arkham
The main phase, per Bitquery's data, ran from 06:24 to 06:50 UTC (03:24 to 03:50 Brasília time). In those 25 minutes, the exchange's hot wallets paid the attacker across ten blockchains. On Ethereum, according to Bitquery, 2,852 ETH left alongside USDT, USDC, and roughly 185 other tokens, totalling $29.7 million. On Bitcoin, 106.07 BTC departed, with 104.43 BTC moving in a single transaction, worth $8.3 million. The remainder was split across Solana, Stellar, Arbitrum, Tron, Polygon, Avalanche, XDC, and BNB Chain. Security firms cited by Cointelegraph described the operations as standard signed transfers, not the exploitation of a smart contract vulnerability.
Phase 2: Stablecoin Freezes
The first response came not from the exchange but from stablecoin issuers. Per Bitquery's timeline, Tether froze USDT0 on Polygon at 10:21 UTC, then USDT on Tron and Ethereum at 11:37, on Solana at 14:55, and the USAT stablecoin at 15:42. Paolo Ardoino, Tether's chief executive, confirmed more than $4.5 million in frozen USDT, a figure cited by both The Record and CNN Brasil. Paxos froze PAXG and USDP at 14:28 UTC.
The aggregate frozen figure depends on which timestamp you use. Bitquery counted approximately $7.3 million frozen, representing 15% of the total stolen: $5.9 million from Tether and $1.5 million from Paxos. Circle, as of the last available data point, had not frozen anything, leaving roughly $4.3 million in USDC and EURC still moveable. Cointelegraph, at 16:42 UTC, reported $6.2 million frozen across Tether and Circle combined. The ability to freeze funds is one of the practical differences between stablecoin issuers, as our comparison of USDT and USDC explains. Tether, according to Cointelegraph and Bitcoin Magazine, had invested $20 million in Mercado Bitcoin back in July.
Phase 3: Communications and Deposit Addresses
Mercado Bitcoin's first post on X went out at 12:56 UTC (09:56 Brasília time). According to the text reproduced by InfoMoney, the exchange said it had “quickly identified and contained” an incident in one of its systems, that no customer data had been compromised, and that deposits and withdrawals were suspended as a precaution. At 14:24 UTC a second post published destination addresses on Bitcoin, Ethereum-compatible networks, Solana, Stellar, and Tron to allow public tracking. CNN Brasil reported that the exchange's teams were coordinating measures “with the relevant authorities,” without naming them.
The most sensitive issue concerns customer deposit addresses. Per Bitquery's data, from 12:10 UTC the attacker began draining them, and was still doing so at 15:44: 35,853 addresses on Ethereum for approximately $261,000, and 53 on Bitcoin. Bitquery inferred that the attacker could sign for any deposit address, since these typically derive from a single master key. That is an inference, not a confirmed on-chain finding. Security experts cited by The Record challenged the exchange's claim of no customer harm on exactly this basis.
Phase 4: Where the Funds Went
Arkham counted 287 swaps from the attacker's wallets, used to sell smaller tokens. Bitquery flagged movements through the Mayan and Chainflip bridges totalling roughly $1.6 million in ETH, while the Relay service rejected two orders. By 16:42 UTC, according to Cointelegraph, approximately $20 million had already moved to new wallets while more than $20 million remained at addresses flagged by Mercado Bitcoin, including all 106 BTC. No source has attributed the attack to a specific group. When funds spread across ten networks, the question of which network a stablecoin runs on becomes material, because it determines who has the power to freeze it.
What “No Customer Harm” Actually Means
According to Bloomberg, as reported by Bitcoin Magazine, Mercado Bitcoin stated it would absorb all losses. Reading that claim carefully: users who hold crypto assets on a custodial platform do not own the underlying addresses. They hold a claim against the platform. If the exchange covers the shortfall, customer balances remain intact even when on-chain data shows those addresses emptied. The distinction between self-custody and custodial arrangements is covered in our guide on self-custody, exchanges, and wallets compared.
In the meantime, customers cannot move their funds and no reopening date has been announced. Cointelegraph notes that any confirmed data breach would trigger a mandatory notification to Brazil's data protection authority. MB stated it will update customers through official channels only, and sticking to those channels is also the first line of defense against scams impersonating exchanges and regulators. Anyone planning to transfer funds to a personal wallet once the platform reopens can start with this guide on how to open a crypto wallet.
Brazil's Regulatory Framework
The attack landed in the same week that the Banco Central's new licensing regime took full effect. According to Capital Aberto, rules governing companies offering crypto-asset services entered into force on February 2. October 30 marked the deadline for submitting the first phase of the authorization application, a prerequisite for continuing to operate during the review period. Exame reported that MB filed its application on time. The framework requires separation of client and proprietary funds, governance structures, and cybersecurity standards for key custody; updated prudential requirements are expected in 2027. None of the sources reviewed included a comment from the Banco Central on the attack itself.
The Mercado Bitcoin Attack: What We Know
What is confirmed and what remains unclear
- Confirmed: an incident affecting one of MB's systems on the night of November 2; deposits and withdrawals suspended; destination addresses published; Tether and Paxos freezes recorded on-chain.
- Not disclosed: the official loss figure, the compromised system, the parties responsible, and the reopening date. Estimates of $40 — $48.5 million come from third-party analysts, not MB.
- To watch: the platform's reopening and how losses will be covered, the deposit addresses still exposed, and any potential Banco Central response.
The Bigger Picture
Four days earlier, on October 29, Binance suffered what TRM Labs estimates at $6.36 billion, making it the largest crypto theft on record per Nextgov, with the FBI attributing the attack to North Korea. No source links the two incidents. Our reading is that both shift attention away from smart contract vulnerabilities toward operational security: private keys, hot wallets, and internal access controls. When an attacker signs ordinary transfers, the blockchain itself has nothing unusual to flag.
The other lesson concerns who actually stopped the funds. In the first hours, the most effective defense came from stablecoin issuers, with Tether leading the response, which underscores Tether's dual role between stability and systemic concentration: a genuinely useful power during an attack, but one held by very few private entities. The signals worth tracking now are the reopening date, an official loss figure, and the Banco Central's next move just days after the authorization deadline passed.
