Mercado Bitcoin, Brazil’s largest crypto exchange, will let customers log in again on Monday 9 November, but only to look at their balances. Withdrawals, deposits and trading stay shut a week after the Mercado Bitcoin hack of 2 November, which outside trackers put at between $40 million and $48.6 million, and the company says it will make every customer whole, buying back with its own money what it cannot recover. Separately, on Friday 6 November, the digital bank Nubank and the payments app Mercado Pago froze crypto transfers to and from outside wallets, each blaming an outside vendor it did not name.
These are two different events. No company, investigator or outlet whose reporting we read has said they are connected, and this article treats them apart. The hack is confirmed by Mercado Bitcoin itself. The freezes are confirmed by both companies, but their cause is not: online claims that a custodian or a blockchain analytics firm was hacked remain unproven.
Mercado Bitcoin hack: what happened on 2 November
The exchange, MB for short, announced the incident on X on Monday 2 November. “We identified and swiftly contained a security incident in one of our systems early this morning,” the exchange wrote, as quoted by The Block. It suspended deposits and withdrawals “as a preventive protection measure”, according to Decrypt, and said customers had suffered no losses and no data had leaked. It then published the addresses the funds had been sent to, on EVM networks, Bitcoin, Solana, Stellar and Tron, so that security firms and token issuers could follow them.
The word “contained” is now disputed. The analytics firm Bitquery, in findings reported by CoinDesk Brasil on 5 November, says the attacker emptied 36,042 customer deposit addresses on Ethereum between 12:27 and 16:56 UTC on 2 November. MB said the incident was contained at 12:56 UTC. On Bitquery’s timeline, the draining therefore went on for about four hours after that statement. Those Ethereum deposit addresses held only about $266,000 in total, according to the same report; the bulk of the theft came from elsewhere. MB was not available for comment, CoinDesk wrote.
Emmett Gallic, an analyst at Arkham, said the attacker was sweeping funds from older deposit addresses and selling memecoins and other altcoins, The Block reported. Fabrício Tota, MB’s vice president of new business, said in a video released on 5 November and reported by BitNotícias that most of the diverted funds sat in hot wallets, the online wallets an exchange uses for daily withdrawals. MB keeps about 5% of its assets in hot wallets, he said, and the cold wallets were reportedly not touched. The company has not explained how the attacker got into its systems.
For readers new to exchange custody: a centralized exchange holds customers’ coins in wallets it controls, mostly offline (cold) and partly online (hot) for speed. A customer’s balance is a claim on the exchange, not coins in a wallet of their own. Our guide to how a centralized exchange works, from KYC to custody explains the set-up and why a hack of the hot side can freeze everyone.
How much was taken: four estimates and the company’s own numbers
Nobody agrees on the exact size of the Mercado Bitcoin hack, and MB has never given a single total. Each figure below comes from a different firm, counted at a different moment.
| Who | Figure | Reported by, date | What it counts |
|---|---|---|---|
| Hypernative | more than $40 million | Decrypt, 2 Nov | suspicious transfers over at least 10 chains, preliminary; not confirmed by MB |
| Arkham | about $46.3 million | The Block, 2 Nov | assets in wallets attributed to the attacker |
| Bitquery | $48.6 million | CoinDesk Brasil, 5 Nov | stolen across 10 blockchains |
| Mercado Bitcoin (Fabrício Tota) | more than $16 million blocked, about $33 million still with the attacker | BitNotícias, 6 Nov | about 3% of total custody, by Tota’s account |
Arkham’s tally, as broken down by CryptoSlate, included about $8.37 million in ether, $8.24 million in bitcoin and $1.76 million in the memecoin PEPE. Added together, MB’s two numbers come to roughly $49 million, close to Bitquery’s figure. That sum is ours; MB did not give it. Tota described the part still held by the attacker as “more or less 3% of our total custody” (our translation of “mais ou menos 3% da nossa custódia total”).
Frozen is not recovered: Tether, Circle and the other issuers
The quickest response came from stablecoin issuers, which can blacklist addresses holding their tokens. “Tether froze more than 4.5M USDT related to this security incident,” Tether’s chief executive Paolo Ardoino wrote on X on 2 November, as quoted by Decrypt. Tether is not a neutral party here: it announced a $20 million strategic investment in MB in July 2026, CryptoSlate notes. Our page on Tether, its reserves and its record of freezes explains how those blacklists work.
The on-chain analyst Specter, cited by CryptoSlate, counted more than $9 million (the headline figure is $9.17 million) immobilised across nine assets, among them USDC, the gold token PAXG and Ripple’s RLUSD. CoinDesk Brasil says partners including Tether, Circle and Chainalysis helped freeze more than $15 million. Tota put the blocked amount above $16 million and named Tether, Circle, Paxos, Stellar and Chainalysis as the firms that helped.
A freeze stops the attacker from moving those tokens. It does not put them back in MB’s custody, and none of the sources says when, or whether, the frozen sums will be returned to the exchange.
Mercado Bitcoin’s promise to cover customer losses
MB pledged on 3 November to cover all user losses, CoinDesk Brasil reported. A day later, the exchange told Cointelegraph Brasil that its trading desk was preparing the repurchases needed “in the domestic and international markets” (our translation) and pointed to its cash position and to Tether’s investment.
In his 5 November video, Tota went further. The buyback plan “is already being carried out”, he said, and “the whole balance in assets of the clients who were here at the time of the incident will be honoured” (our translation, as reported by BitNotícias). What MB cannot recover, it says it will buy back with its own funds. It has not said how much it will spend, which coins it will buy first or when the replacement will be complete. BitNotícias adds that more than 300 employees are working on the investigation, recovery and restart, and Tota said MB has raised more than $300 million in funding rounds.
That is a promise, not a verified result. No auditor or regulator has said publicly that MB’s reserves cover client balances after the theft.
What Mercado Bitcoin customers can and cannot do from Monday
The restart comes in two steps, according to BitNotícias (6 November) and Cointelegraph Brasil (4 November).
- From Monday 9 November, customers can log in on MB’s website and see their balances, statements, assets and investments. The figures show positions as they stood before the incident.
- Withdrawals stay suspended in that first phase, and so do deposits and trading.
- In a second phase, trading, deposits and withdrawals of crypto and of reais return gradually, by group of assets and by blockchain network, once security procedures and independent security tests are completed. No date has been given.
“Next Monday, we start this process,” Tota said in the video (our translation). The exchange said it would post updates on X, according to Decrypt. Until it confirms that a given network is open again, customers have no way to move coins out of MB.
Who did it: no group named
MB has not said who is behind the attack, and no investigator has named a group. Investigators have not established any connection with North Korea’s TraderTraitor, the group the FBI blamed for the Binance theft of late October, CryptoSlate reports, and MB has not linked its incident to Binance’s, according to Decrypt. One other platform may have been hit by the same hands. Sheldon Xia, founder of BitMart, said BitMart was hacked on 2 November and that his preliminary investigation points to the group behind the MB attack, CoinDesk Brasil reported. Bitquery says the same attacker took about $391,000, mostly from wallets it links to BitMart; BitMart has not confirmed that attribution.
MB says it is working with “authorities” and specialised firms. None of the sources we read names an agency, and we found no statement from the Banco Central do Brasil, the securities regulator CVM or the Polícia Federal on the incident.
Nubank and Mercado Pago froze crypto transfers, blaming a vendor
The second event began on the morning of Friday 6 November. In a statement timestamped 12:01, Nubank said crypto deposits and withdrawals in its app were “temporarily unavailable because of instability at an external data provider” (our translation), according to Livecoins. The problem was not in Nubank’s own infrastructure, the bank said, and all assets and customer information remained protected. Buying and selling crypto inside the app kept working, as did Pix, Brazil’s instant payment system.
At 16:26 came a statement from Mercado Pago, the fintech arm of MercadoLibre. It blamed “an incident at an external risk-monitoring and anti-money-laundering provider” and said “part of the transfers to external wallets were blocked as a precaution” (our translations, from Livecoins and O Tempo). Deposits could arrive late and would be credited automatically once the service returned; buying and selling continued normally. Revista Poder, citing Reuters, reports that the restrictions also reached Mercado Pago’s operations in Chile and Mexico.
Neither company named the vendor, said how many customers were affected or gave a restart date. Nubank has about 120 million customers in Brazil, Revista Poder notes, but only those moving crypto between the app and an outside wallet were blocked. Both said client assets remained protected. A suspension does not mean coins were lost or taken from the account, Metrópoles noted, and no customer loss has been reported at either.
Two custody firms appear in the story, and neither is blamed by the companies. Fireblocks, which keeps Nubank’s crypto according to the app’s support pages as cited by O Tempo, said “the interruption of Nubank’s services is not the result of any problem on the Fireblocks platform” (our translation, from O Tempo). Mercado Pago’s custodian is Paxos, according to its own site as cited by Metrópoles, which does not tie Paxos to the incident.
The Paxos and Chainalysis rumours are not confirmed
By mid-morning on Friday, a Brazilian analysis house, Paradigma Education, had posted on X that Nubank froze transfers after an alleged hack at its service provider. Livecoins reported that the rumour pointed at Paxos. No outlet we read verified the post. Paxos had made no public comment, and its status page showed only a deposit delay on 4 November marked as resolved, with no incident on 5 or 6 November, Livecoins found. Nothing public supports the claim that Paxos was hacked.
The second name in circulation is Chainalysis. Exame reports that Nubank’s direct transfers to outside platforms work through a partnership with the blockchain analytics firm. Rocelo Lopes of the crypto firm Truther suggested to O Tempo that a problem at a firm that screens blockchain transactions could make institutions pause transfers, and cited Chainalysis as an example. He did not say Chainalysis was the cause, and neither bank named it.
Chainalysis is dealing with its own breach. Its incident page says its KYT transaction monitoring and Address Screening products went offline at 10:30 EST on Wednesday 4 November, and that names, usernames, password hashes and live tokens of all users were exposed. Phased restoration of both products began at 3:30 EST (08:30 UTC) on Friday 6 November; its Reactor investigations tool remained offline with no date. The page names no customer. We covered the breach in our report on the Chainalysis incident.
The freezes did fall while Chainalysis was bringing its services back, BitNotícias notes, but the same outlet states plainly that there is no confirmed link between the incidents. Nubank did not name the supplier that failed. Until one of the companies says otherwise, the vendor is unknown.
Has Nubank resumed crypto withdrawals?
According to BitNotícias, yes. Its reporter Cassio Gusson wrote on Saturday 7 November at 10:30 that crypto deposits and withdrawals at Nubank were working again from 22:00 on Friday, quoting the bank: “Nubank reports the normalisation of withdrawal and deposit operations on its crypto platform” (our translation). We could not confirm this independently. We found no second outlet reporting it and no notice on a Nubank page we could open, so the restart rests on that one report.
For Mercado Pago, BitNotícias had found no official statement confirming a full restart when it published. We found none either as of 17:45 UTC on Saturday. Buying and selling crypto kept working at both companies during the freeze, according to their statements, and Pix transfers ran normally in both apps, Livecoins reported.
Two events in one week, and no stated link between them
It is tempting to see one story in a single week of Brazilian crypto freezes. The sources do not allow it. MB described an intrusion into its own systems. Nubank and Mercado Pago described a failure at a supplier and blocked transfers as a precaution, with no theft reported. Metrópoles says there is no confirmation that even the Nubank and Mercado Pago problems share an origin. Revista Poder, which mentions both the Binance hack and the MB incident, says no published evidence ties the two disruptions to attacks on other platforms.
What the two events do share, in our analysis, is a dependence on a few outside firms. The same names come up in both: stablecoin issuers that can freeze tokens, custodians such as Fireblocks and Paxos, and analytics providers such as Chainalysis. When one of those links fails, or is suspected of failing, customers of several platforms can lose access to their coins at once, even when nothing has been stolen from them.
Brazil’s central bank crypto rules: the backdrop
Both events land in the middle of Brazil’s switch to licensed crypto platforms. Under the Banco Central do Brasil’s rules, crypto firms already operating had to file the first phase of an authorisation request by 30 October 2026, as set out in our explainer on Brazil’s crypto licence deadline. A filing lets a firm keep operating while the central bank reviews it. It is not a licence, and the BCB has up to 1,080 days to decide on firms that were already active.
Those rules bear directly on the questions customers are now asking. Firms that file must segregate client assets and, from the date of filing, send the BCB client data, daily balances, custody figures and monthly proof of reserves. Banks already offering crypto get their own version of that duty from 1 January 2027; Itaú, for instance, put its crypto brokerage on file on 27 October, as we reported in our story on Itaú’s notification to the central bank.
One date coincides with the freezes. From 6 November, under Resolution BCB 589 of 23 September, institutions authorised by the central bank may no longer carry out or enable virtual-asset operations with providers that are not authorised to operate in Brazil, save for cases the rules allow, as Capital Aberto reported in October. The text does not say clearly whether firms still awaiting a decision count as authorised. Neither Nubank nor Mercado Pago tied its freeze to that rule; both blamed a vendor incident. We found no statement on Mercado Bitcoin’s own filing and no statement from the BCB or the CVM on any of the three companies’ incidents.
In our analysis, MB’s restart is the first public test of how a platform under the new regime handles a large theft: how it reports the loss, proves it can still cover client balances and reopens. If MB has filed, the reporting rules mean the central bank should see those figures even if the public does not.
What is still unknown, and the dates to watch
Several basic facts are missing. MB has not said how the attacker got in, who the attacker is, the final size of the loss, whether any frozen funds have been handed back or what it has bought back so far. Nubank and Mercado Pago have not named their vendors. Mercado Pago has not confirmed a restart, and Nubank’s rests on a single report. No Brazilian authority has spoken on the record.
The next date is Monday 9 November, when MB customers should be able to see their balances on the website. The second phase, with withdrawals, has no date. Chainalysis has given none for Reactor either. We will update this piece when MB opens its first networks or when either bank names the supplier behind Friday’s freeze.