Nearly $49 million stolen from Mercado Bitcoin across 17 networks on November 2
Key Facts
Chainalysis said an attacker began moving assets from wallets belonging to Mercado Bitcoin in the early hours of November 2, 2026, across 17 blockchain networks, estimating the stolen amount at about $49 million. The company described the movements as taking place in waves, in an incident that left the platform facing significant losses and containment measures involving cooperation with law enforcement and industry partners. In a separate assessment, a Bitquery report said the platform’s hot wallets sent assets worth $48.5 million to a hacker across 10 networks that day. Bitquery calculated the amount using the value of the assets at the time of transfer, explaining the difference from Chainalysis’s approximate estimate. Chainalysis said it worked with Mercado Bitcoin and the relevant parties to help freeze nearly $10 million of the stolen funds.
Coordination with Tether enabled the freezing of more than $9 million in stolen funds held in USDT, according to Chainalysis. The action offers a glimpse of the industry’s response to the attack, with part of the funds blocked in cooperation with digital-asset issuers and other parties involved. But Chainalysis’s estimate of the amount it helped freeze differs from Bitquery’s tally for the funds frozen by Tether and Paxos combined. The Bitquery report said the two companies froze assets worth $7.3 million, while Circle had not frozen any funds at the time of the report’s latest check. These figures relate to Bitquery’s tracking on November 2, while Chainalysis referred to a broader response involving several parties.
The Bitquery report broke down the value of assets frozen by each company, saying Tether blocked $5.9 million in USDT, USDT0, USAT and its gold-backed token. The frozen assets spanned the Polygon, Tron, Ethereum and Solana networks, according to the report. Paxos also froze $1.5 million worth of its PAXG and USDP tokens. The breakdown by company and token shows that the freezes involved more than one digital-asset issuer, with figures varying according to the parties and tokens tracked by each report. By contrast, the Bitquery report said Circle had not frozen any funds at the time of its check.
Regarding the incident’s impact on platform users, CNN Brasil quoted Mercado Bitcoin as saying the company temporarily suspended access to its services as a precaution after activating security protocols. The company did not specify a date for resuming service in the statement cited, and said it would announce the return date in later updates published centrally through its official channels. CNN Brasil also quoted the platform as saying it had identified additional assets that could be blocked and was continuing efforts to expand the recovery of assets. The platform’s response therefore involved two tracks: a temporary suspension of services and expanded efforts to block other funds. The cited statement gave no timeline for restoring access.
The Bitquery report said flows from Ethereum deposit addresses continued after the attack was declared contained, adding subsequent movements to the tracking effort. This observation comes alongside the initial tracking of transfers from the hot wallets on the day of the incident, without changing Chainalysis’s overall loss estimate of about $49 million. Chainalysis said the funds moved across 17 networks, while Bitquery’s analysis covered transfers it tracked across 10 networks. The Chainalysis report cited Base, Tron and Polygon as examples of smaller networks involved in the activity. The public Chainalysis report did not identify the attack method, so the published information here does not provide confirmed details on how the attacker gained access to the assets.
Mercado Bitcoin pledged to absorb the losses and said it did not expect customers to lose money, according to CoinDesk. The platform also said customer data had not been leaked, the same source reported. The pledge puts the handling of the incident’s losses at the center of the company’s response, alongside the service suspension and efforts to recover assets that can be blocked. As for tracking the remaining funds, Chainalysis said it was continuing to trace and monitor their movements and look for further opportunities to intervene. Mercado Bitcoin, for its part, said it would publish further updates through its official channels, without specifying a date for resuming service in the statement cited by CNN Brasil.