Mercado Bitcoin
- Funds lost
- $49K
- Attack type
- Access Control
- Network
- Ethereum, Polygon, Solana, Base, Arbitrum
- Category
- CeFi
Summary
In the early hours of November 2, 2026, Brazil’s largest cryptocurrency exchange, Mercado Bitcoin, suffered a multi-chain security incident in which attackers drained approximately $38M to $49M in digital assets across 17 blockchains.
Details of the Exploit
The attack began at 01:22 UTC on November 2, 2026, with unauthorized wallet sweeps originating on Base and quickly expanding across 17 blockchains, including Bitcoin, Ethereum, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain, and Stellar. Rather than exploiting smart contracts, the attacker authorized standard token transfers to sweep multi-chain hot wallets and thousands of user deposit addresses, indicating compromised withdrawal permissions or API signing access. Drained assets included 104.43 BTC (~$8.16M), 3,680 ETH, SOL, TRX, stablecoins, and extensive ERC-20 and SPL token holdings (including PEPE, ONDO, PENDLE, VIRTUAL, and UNI), which the attacker immediately began swapping into native ETH and BTC via decentralized exchanges.
Blockchain security firms and stablecoin issuers intervened to freeze ~$11 million (including $6.2M+ in USDT/USDC), while Mercado Bitcoin initiated a full infrastructure review prior to restoring app services.
Source: De.Fi REKT Database. Data as of November 5, 2026.