Mercado Bitcoin

What happened

On November 2, 2026, attackers compromised a system at Mercado Bitcoin and transferred more than $40 million in crypto from exchange-associated wallets across various blockchains. The exchange contained the incident and temporarily suspended deposits and withdrawals while investigating the transfers. Tether froze more than $4.5 million USDT associated with the theft. Mercado Bitcoin stated that customers would not incur losses and that no customer data was exposed

Details

Date

Nov 2, 2026

Kind

Hack or exploit

Method

Unknown

How in

Smart contract bug

Target

Centralized exchange

Chains

Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain, Stellar, XDC

What would have stopped it all controls for this way in

• The audit covers the code that ships, including upgrades and new modules; changed code is reviewed again.
  Check: The deployed bytecode matches the audited commit; a diff since the last audit is empty or reviewed.
• A whitehat Safe Harbor or bounty offer is published before any attack, so a rescuer or an attacker has a set way to return funds.
  Check: The terms and the return address are public and fixed in advance.

General guidance for this kind of attack, not a finding about this incident.

After the theft

Frozen

$4.5M
“Tether froze more than $4.5 million USDT associated with the theft.” (DefiLlama)

How sure: 0 of 4 checks what the checks mean

• Witnessesone source so far
• Same storyneeds a second source
• Blockchain receiptno public attack transaction checked
• Official wordno official statement linked

Who says what

• DefiLlama ↗$40M

Figure used: $40M, the figure DefiLlama gives. Each source's own figure is in dollars at the time.

Related incidents