Ask around how much Brazil’s biggest crypto exchange just lost, and you’ll get a different number every time. Hackers drained Mercado Bitcoin days after the biggest crypto hack in history, and the exchange confirmed a security incident early Monday. Estimates of the exchange hack losses range from $38 million to $49 million, depending on who is counting.
I’ll say it: two exchange breaches in one week is not a coincidence you want to ignore if you keep money on an exchange.
What we know about the Mercado Bitcoin exchange hack
The incident began in the early hours of Nov. 2. On-chain analysts say the attacker emptied hot wallets across at least 10 blockchains. The exchange suspended deposits, withdrawals and app access. It says it contained the incident, and its statement says customers “will not suffer any loss of assets,” translated from Portuguese.
The size of the hit depends on the source. Mercado Bitcoin puts about $38 million in “assets involved.” Bloomberg reports the exchange will absorb a $40 million loss. Arkham counts at least $46 million. Chainalysis estimates about $49 million across 17 chains.
Four sources, four numbers. There is no official confirmed one yet.
The timing stings. Binance suffered the far bigger crypto heist just days earlier, and our breakdown of the $6.3 billion Binance attack shows how large that one was.
How a crypto heist got partly frozen
Here’s the part worth understanding. Companies issue stablecoins, and companies can lock them. Tether CEO Paolo Ardoino said Tether froze more than 4.5 million USDT tied to the incident. Chainalysis says it prioritized freezing stablecoins before the attacker could swap them into Bitcoin or ether, which nobody can freeze. In total, the exchange says it has frozen about $11 million, working with Tether, Circle, Paxos and Chainalysis.
Those freeze figures overlap, so don’t add them up. And a freeze is not a refund.
Tether’s Ethereum contract blocks the attacker from moving the coins, but it does not send them back to Mercado Bitcoin.
Did customers really lose nothing?
That’s the question everyone will be asking. The Record reports that several security experts dispute the claim that customer funds were untouched. They point to on-chain evidence of money siphoned from some customer wallets. Bitquery says it counted 35,853 deposit addresses emptied.
The exchange says it will make customers whole, but nobody can check that promise on-chain.
Several key facts remain unknown: how the attacker got signing access, which system they compromised, and who is behind this exchange security incident. Nobody has named a group, and there is no public evidence tying this to last week’s Binance hack.
Why U.S. readers should care about this exchange hack
Here’s the thing: this exchange hack is a lesson in who actually controls your crypto. The freezes came from U.S.-based stablecoin issuers like Tether, Circle and Paxos. If your savings sit in an exchange’s hot wallet, you’re trusting that exchange’s security. If your money sits in stablecoins, you’re also trusting the issuer’s ability to hit the brakes.
Binance is rebuilding trust too, and you can see how that process works in its phased reopening of withdrawals after its own hack. Mercado Bitcoin has not given a reopening date. It says services return once full security conditions are met, and any update will come through official channels. Chainalysis is still tracing the remaining funds, so more freezes are possible.
Still waiting on an official loss figure, a root cause and the details of the reimbursement plan. Until then, the question for every exchange user is the same one: where exactly is my money sitting tonight?
