Mercado Bitcoin: intrusion drains an estimated $40-46M+ in crypto; deposits and withdrawals suspended
Severity: high · Patch status: no-fix-needed · Since 2026-11-02
Mercado Bitcoin, which describes itself as Latin America's largest digital-assets platform with about 4.5 million customers, detected a security incident in one of its systems early on 2 November 2026 and suspended deposits and withdrawals as a precaution. The company says no customer was harmed and no data leaked, and it has published destination addresses; it has not confirmed any loss figure or cause. Outside estimates run from about $40M (Hypernative, via Tecnoblog and CoinDesk) to more than $46M (an Arkham analyst, via TechFlow) across at least ten chains. On-chain reporting says funds kept leaving incident-linked addresses for hours after the pause, which blockchain-security experts cite against the no-harm claim. Tether reported freezing about $4.5M of USDT, and roughly $6M or more is reported frozen in total. No group has been officially named; the North Korea link appears only in an unnamed-source report and is unconfirmed. Chainalysis announced its own intrusion involving AI-backed tools last week, and the FBI and Secret Service have blamed North Korean hackers for the separate $6.3B Binance theft. The latest source reviewed (TechFlow, 3 Nov 2026) gives no date for reopening. No vendor fix applies; the response is asset tracing, freezing and withdrawal monitoring.
What to do
- Monitor Mercado Bitcoin status before transacting; deposits and withdrawals were still suspended in the latest sources reviewed (3 Nov 2026)
- If holding assets on the platform, review exposure and follow official withdrawal guidance once service resumes
- Exchanges and custodians: screen for the destination addresses the company published (EVM, Bitcoin, Solana, Stellar, Tron) and freeze matching deposits
- Track Chainalysis and Tether updates on fund tracing and freezing efforts
- Harden hot-wallet controls and withdrawal monitoring against similar exchange heists
Sources
All live incidents on Threat Watch
