Early on Nov. 2, attackers began moving funds out of wallets tied to Mercado Bitcoin, which Chainalysis describes as Brazil’s largest crypto exchange. Most transfers landed in a window of roughly 06:19 to 06:53 UTC, according to one analysis. Security firm Hypernative spotted the outflows first.

Plain-English version: exchanges keep a small working balance in “hot” wallets that stay online to process withdrawals, and most customer funds in offline cold storage. The exchange says only its hot wallet was hit. Attackers who control a hot wallet can send funds out across many blockchains at once, which is what happened here.

According to Chainalysis, a Mercado Bitcoin director called for help at about 2:30 a.m. ET, and Chainalysis contacted law enforcement within 30 minutes. The exchange later published five destination addresses covering EVM chains, Bitcoin, Solana, Stellar, and Tron so other platforms can block them.

How Much Was Stolen, and How Much Is Frozen?

The number has grown as analysts traced more wallets:

  • Hypernative: over $40M on at least 10 chains
  • Arkham: about $46.3M
  • Chainalysis and the exchange’s 21:00 Brasilia update: about $49M, across up to 17 chains, mostly BTC and ETH

About $11M was frozen as of that update, over $9M of it by Tether. The exchange lists Tether, Circle, BRL1, Paxos, and Chainalysis among its partners and says more freezable funds were identified. That is roughly 22% of the total, by TechFlow’s calculation.

The freeze power sits with stablecoin issuers. BTC and ETH cannot be frozen once moved, so how much is recoverable depends largely on what the attacker holds in stablecoins. On Nov. 3, Arkham reported the attacker moving about $8M in ETH, with about $46M still held.

Are Customers Safe?

The exchange’s position has shifted slightly. Its first notice said the incident was contained, with no customer losses and no data breach. Its 21:00 update instead guaranteed that customers would not lose assets, noting that most assets sit in cold wallets. The Record reported that some experts questioned the “no customer losses” claim based on on-chain data.

Two things are consistent across reports: the exchange is absorbing the loss, and withdrawals stay off until it confirms security. The compromised system has not been identified, so users are relying on the exchange’s word.

Is This Linked to the Binance Hack?

Not on current evidence. Both involved hot wallets drained across many chains in a short window, which is why the comparison is natural. But CoinDesk reports there is no public evidence tying the two together, and the FBI attributed Binance to North Korea’s TraderTraitor, not this incident. A similar pattern is not proof of a shared attacker.

Why It Matters

Binance showed an exchange can survive a $6B theft. Mercado Bitcoin shows how mid-sized exchanges are exposed to the same hot wallet risk, with less capital to absorb it. Two exchange breaches in four days, with hot wallets draining across a dozen-plus chains, is why custody controls are now the story. Watch for a root cause from the exchange and whether the stolen funds start moving to mixers.