News Desk · Crypto crime

Brazilian crypto exchange Mercado Bitcoin hit by hack, pauses deposits and withdrawals

Mercado Bitcoin, which The Block described as Brazil's largest crypto exchange, confirmed a security incident on 2 November 2026 and suspended deposits and withdrawals. Mercado Bitcoin put its loss at around $38 million, while Chainalysis estimated about $49 million was stolen.

Developing storyCrypto crimeBrazil2 Nov 20262 min readUpdated 5 Nov 2026

Mercado Bitcoin confirmed on Monday, 2 November 2026, that it had suffered a security incident in one of its systems, The Block reported. The exchange temporarily suspended deposits and withdrawals as a precaution, according to The Block, and its teams were investigating, tracing the assets and coordinating with authorities, according to The Block and CoinDesk. No authority has been publicly named as investigating, and no one has been publicly identified as responsible.

Estimates of the loss differ. Mercado Bitcoin said around $38 million was lost, according to CoinDesk. Blockchain analytics firm Chainalysis estimated in its own published analysis that about $49 million was stolen, and said the attacker began moving assets held across 17 blockchains in the early hours of 2 November. The Block reported a figure of about $46.3 million based on Arkham data.

Part of the stolen funds has been frozen. Mercado Bitcoin said $11 million had been frozen, according to CoinDesk, which reported that Tether, Circle and Chainalysis helped. Chainalysis said its work led to nearly $10 million in freezes, after a Mercado Bitcoin director contacted it and it passed freezable addresses to law enforcement. Tether's chief executive Paolo Ardoino confirmed that Tether had frozen more than 4.5 million USDT linked to the incident, The Block reported.

Mercado Bitcoin said it would cover the losses and expects customers to suffer no losses, according to CoinDesk. The exchange also published the destination wallet addresses of the stolen funds, The Block and The Record reported.

Developing story. This account is based on reporting by established news organisations and on statements by the parties involved, as listed in the sources below. No regulator, court or government agency had published an official statement when it was written. Claims are attributed to the people or firms who made them, and the story will be updated as official information is released.

Why it matters to AML professionals

After an exchange hack, the stolen assets are usually split across many wallets and chains and swapped quickly, so the funds can reach other exchanges and payment firms within hours. Stablecoin freezes in this type of case depend on fast sharing of wallet addresses between the victim, analytics firms, issuers and law enforcement. AML professionals at exchanges and payment firms need to screen deposits against published hack addresses as soon as they are released.

Red flags in this case

Incoming deposits traced on-chain to wallet addresses published by a hacked exchange
Rapid swaps of many small altcoins or memecoins into major assets shortly after a large outflow from an exchange
Funds from a single outflow split across several blockchains within a few hours
Newly opened accounts receiving crypto and requesting immediate withdrawal or conversion to fiat

If this landed in your queue

Check whether the deposit's source addresses appear in the victim exchange's published list or in your blockchain analytics alerts
Hold the funds where your procedures allow and escalate to your financial crime or sanctions team without alerting the customer
Review the customer's KYC profile, account age and recent activity for signs of a mule or nominee account
File a suspicious activity report and share the addresses with law enforcement and the victim exchange through official channels

Key terms

Hot wallet: A crypto wallet connected to the internet that an exchange uses for day-to-day deposits and withdrawals.
Stablecoin freeze: An action by a stablecoin issuer such as Tether or Circle to block tokens held at a specific address so they cannot be moved.
Blockchain analytics: Tools and services that trace crypto transactions across addresses and chains to follow the flow of funds.

Interview angle

A customer deposits crypto that your analytics tool links to a recent exchange hack. What do you do?

Explain how you would confirm the link using the published addresses and your analytics tool, hold the funds under your procedures, avoid tipping off the customer, escalate, file a suspicious activity report and cooperate with law enforcement and the victim exchange.

Sources

Go deeper on AMLift

Get the next story in your feedFollow AMLift on LinkedIn for new enforcement breakdowns, the weekly AML challenge and new tools.

Follow on LinkedIn

Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.