EL7.AI
CryptoMedium•2 November 2026•
3 min read

Suspicious Transfers Exceeding $40 Million Precede Mercado Bitcoin’s Suspension of Deposits and Withdrawals

Key Facts

1Hypernative estimated the suspicious transfers at more than $40 million, with the actual loss and wallet ownership still undetermined.
2Mercado Bitcoin temporarily suspended deposits and withdrawals and did not specify when they would resume.
3Hypernative’s report detected activity on at least 10 networks.
4The first suspicious records appeared at 2:15, and the heaviest activity occurred between 6:19 and 6:53 UTC on November 2, 2026.

Brazilian platform Mercado Bitcoin temporarily suspended deposits and withdrawals after acknowledging a security incident, while Hypernative estimated that suspicious transfers from wallets attributed to the platform exceeded $40 million. The actual loss amount and ownership of the source wallets have not yet been confirmed, so the figure does not represent confirmed losses for the platform or its customers. Mercado Bitcoin said the suspension was a precautionary measure, without specifying when operations would resume. In its statement, the company said: "As a protective measure, deposits and withdrawals have been temporarily suspended." It added that "customers have not suffered any losses" and that "no data leak occurred."

Hypernative’s estimate distinguishes the detection of on-chain transfers from determining the final loss or the party that owns the wallets from which they originated. Forbes Ecuador quoted the company as saying the suspicious transfers could mean potential losses exceeding $40 million, but wallet ownership and the actual extent of the damage have not been determined. The report cited the preliminary estimate on November 2, 2026. At the same time, the platform said customers were unaffected, reflecting the company’s position on the incident’s impact on user accounts. The platform has not disclosed a separate figure for its losses or a final estimate of the assets that may have left its control.

The activity detected by Hypernative involved wallets spread across at least 10 networks, including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Smart Chain and Stellar. According to the report, the first suspicious records appeared at 2:15 UTC on November 2. The heaviest activity then occurred between 6:19 and 6:53 UTC on the same day. The number of networks indicates that the observed transfers spanned more than one chain, but does not by itself establish the size of the loss or the wallets’ owner. Forbes Ecuador reported these details from a Hypernative report.

Hypernative’s report described the transfers as transactions that appeared routine and carried valid signatures, rather than operations resulting from a smart-contract exploit. The report said: "They were executed as conventional transactions, with signatures that appeared valid." The company had not determined how an external party obtained authorization to execute the transfers, leaving the method of access unresolved in the report. This puts the investigation’s focus on how transactions that appeared technically valid were carried out, alongside tracing the funds across networks. The report offered no definitive explanation of how the external party obtained that authorization.

Mercado Bitcoin said its teams are investigating the incident, tracing the assets and coordinating actions with the relevant authorities. Its statement said: "Our teams are working to investigate the case, trace the assets and coordinate actions with the relevant authorities." The company also promised regular updates on developments. Deposits and withdrawals remain suspended, with no date announced for their resumption. The platform has not specified a timeline in the published information for completing the investigation or lifting the suspension, leaving the resumption of operations subject to a subsequent update from the company.