Brazilian cryptocurrency exchange Mercado Bitcoin suspended deposits and withdrawals on 2 November 2026 after detecting a security incident in one of its systems. The exchange said it contained the incident early on Monday morning and described the suspension as a protective measure while its teams investigate, trace assets and work with authorities. No CVE number was cited in the source report, so none is stated here.

The company said customers suffered no harm and no data leaked, but that alone does not confirm no exchange assets were taken. It had not announced a reopening time or which system was affected at the time of reporting.

What researchers flagged

Blockchain security firm Hypernative flagged more than $40 million in suspicious transfers across at least 10 blockchains. The exchange has not confirmed that figure as its actual loss, so it remains a researcher estimate, not a verified loss total.

Most of the reported outflows occurred between 06:19 and 06:53 UTC, a 34-minute window, while earlier Bitcoin activity was reported from around 02:15 UTC. The preliminary researcher count included approximately 2,852 ETH, 106 BTC, 10,700 SOL and 6.7 million XLM, alongside more than 200 other tokens. The affected networks named included Bitcoin, Ethereum, Solana, Tron and Stellar, among others.

Key question still unanswered

Researchers described the movements as ordinary transfers rather than a smart contract exploit, shifting attention to how transactions received valid signatures. The findings do not establish how an attacker obtained signing access.

Mercado Bitcoin later published destination addresses to help track funds on public blockchains. Until the exchange confirms its own loss figure and the entry point, the incident remains confirmed with an unconfirmed financial impact.

Sources: Cyber Security News, Mercado Bitcoin official statement and Hypernative findings as reported by Cyber Security News.