What happened
Mercado Bitcoin said on 2 November 2026 that it had contained an overnight security incident and temporarily suspended deposits and withdrawals. It said customers had suffered no loss and no data had leaked. Bloomberg Línea reported that Mercado Bitcoin would absorb an estimated US$40 million loss tied to hot wallets. The company’s statement establishes an incident and a transaction-service interruption, but it does not identify the breached system, the access method or the signing boundary reached.
Bitquery independently counted US$48.5 million leaving Mercado Bitcoin wallets across ten chains, valued at transfer time; it said US$7.3 million was frozen by Tether and Paxos, leaving US$41.2 million not frozen at its observation point. Bitquery observed the Mercado Bitcoin Ethereum hot wallet 0x5cc7787778b4d20a947dcc53b41f593cfd27d548 being emptied between 06:24 and 06:48 UTC on 2 November 2026. Bitquery said 35,853 Ethereum customer deposit addresses sent balances to the attacker from 12:10 to at least 15:44 UTC on 2 November 2026, more than two hours after the exchange’s 12:56 UTC containment statement. Bitquery’s published observation window ended at 15:46 UTC on 2 November 2026, while the attacker was still active. These are on-chain research findings, not the exchange’s final forensic account.
Published tracking addresses include 0xe485e7a70b1131216cb47ca4555c4bbb2c742478 on EVM chains, 19qGpsHvzh1t6pVi526XNNkh6hW6prDZp on Bitcoin, 3YX6WHncP1Ra4AotE9YLawFt4nPmxyux288FWXkEW97J on Solana, TEX3HuDRHRa3tnYpy96M4UfSx62VhDyA5L on Tron and GDXYRI6IONQA5YTGRLQ6O3FGJ2BWXPJTTQPUXFPSEXSRKBZLFKMZSOLP on Stellar. These indicators give treasury and security teams a concrete monitoring set, while the cross-chain spread means containment must address every signer and deposit-address derivation path rather than one wallet.
Why this matters now
This is not only a cryptocurrency-loss event. Bitquery’s observation that customer deposit addresses could produce valid transfers indicates access to a signing capability, derived-key structure or transaction service broader than one hot wallet. The precise mechanism remains unresolved, but a platform cannot safely infer containment from stopping one process or freezing selected tokens. Custody operations, IAM, deployment pipelines, wallet orchestration and hardware-backed key boundaries all belong in the investigation scope.
The exchange’s promise that customers bear no loss is a financial commitment, not proof that the control plane is clean. Reopening while an old signer, derivation path or operator session remains usable could convert a bounded incident into repeated theft. Security leadership therefore needs separate answers for customer indemnity, cryptographic containment, asset recovery, service availability and regulatory notification rather than one blended status statement.
The decision extends beyond cryptocurrency exchanges. Any enterprise holding digital assets, operating payment wallets or using a custody provider should test whether it can revoke signing authority across every chain, generate replacement addresses, reconcile internal records to public ledgers and continue essential operations without accepting transactions into potentially exposed destinations.
The decision for security leaders
Require a cryptographic closure plan before approving restoration. The plan should enumerate every hot wallet, deposit-address derivation path, signing service, hardware-security module, privileged operator identity and deployment secret that could authorise transactions, then document revocation, rotation or replacement. A service-health check or absence of new alerts cannot substitute for proof that old authority is unusable.
Separate asset recovery from containment. Token freezes and tracing reduce loss but do not establish that the attacker has lost access. Custody operations should produce an independently reviewed chain-by-chain reconciliation, while security teams establish which control plane generated the unauthorised signatures and whether adjacent identity, source-code, build or customer-data systems were reached.
Condition reopening on a controlled canary process using replacement infrastructure and new destination addresses. Finance, legal, compliance and customer operations should agree the communication thresholds for unrecovered assets, delayed withdrawals, address replacement and any evidence that the incident extended beyond wallet operations.
Evidence of closure
- Cryptographic key-retirement record covering every affected wallet and deposit-address derivation path.
- On-chain reconciliation signed by custody, finance and independent assurance owners.
- Forensic report identifying the accessed control plane and confirming containment boundaries.
- Controlled reopening test showing no unauthorised transaction from replacement infrastructure.
The Security.io assessment
The confirmed minimum is a company-acknowledged cyber incident with suspended deposits and withdrawals. Bloomberg’s reporting and Bitquery’s public-ledger analysis establish substantial financial movement, but their US$40 million and US$48.5 million figures reflect different statements, methods and observation points. Neither figure should be treated as the final audited loss.
The cited sources did not publish the initial access vector or establish whether a master key, signing service, wallet-management system or operator account was compromised. The ability to sweep thousands of deposit addresses materially widens the containment question, but the public evidence does not prove which component supplied that authority. Security leadership should preserve that distinction when briefing regulators and the board.
Attribution posture: Mercado Bitcoin has not identified the responsible actor. Public blockchain evidence can trace transactions and counterparties, but it does not by itself identify the operator or establish intent beyond the unauthorised movement. The decisive closure evidence is therefore cryptographic and forensic: retired authority, reconciled balances, clean replacement infrastructure and no residual transaction path.
Questions for the morning meeting
- Which signer, master-key or wallet-management boundary was reached?
- What evidence proves no active transaction path remains?
- How are customer balances protected while assets remain unrecovered?
- Can services resume without trusting any legacy deposit address?