Mercado Bitcoin freezes deposits and withdrawals after over $40M in suspicious transfers

Brazil’s largest crypto exchange has hit the pause button. On November 2, 2026, Mercado Bitcoin (MB) confirmed a security incident in one of its systems and temporarily suspended deposits and withdrawals.

The trigger was more than $40 million in suspicious transfers from wallets linked to the exchange, flagged by blockchain security firm Hypernative.

What happened overnight

According to Hypernative, the suspicious outflows moved across approximately ten different blockchain networks.

Hypernative’s data shows most of the activity landed in a tight window. The bulk of the transfers took place between 3:19 a.m. and 3:53 a.m. local time on November 2.

MB moved to freeze deposits and withdrawals as a precautionary step right after the incident. The exchange says the breach was contained quickly.

Its messaging to customers has been firm on two points. The company said there was “no prejudice to clients” and no data leakage, framing customer asset protection as its top priority.

There is a gap between those two narratives, though. MB has not confirmed the full scope of the transfers Hypernative reported, nor whether any money left customer accounts.

For now, the exchange says it is actively investigating and tracing the assets. It has pledged to keep customers updated with regular communications as the probe continues.

Brazil’s biggest exchange, under new rules

Mercado Bitcoin is Brazil’s largest crypto exchange by user base, serving millions of clients.

MB operates under Brazil’s evolving virtual-asset framework, including new rules from the Banco Central do Brasil. Those rules require prior authorization for a range of virtual-asset services.

What this means for users and the industry

For MB’s customers, the immediate issue is practical: money that cannot move. Deposit and withdrawal freezes are standard defensive moves after a breach, but they still leave users waiting on the other side of a locked door.

The second thing to watch is reconciliation between MB’s account and Hypernative’s figures. Over $40 million in flagged transfers is a specific, public number.

If MB eventually confirms the losses came from company funds and that customers are fully covered, its “no prejudice to clients” line holds up.

Brazil’s central bank now requires prior authorization for virtual-asset service providers, which gives supervisors a direct interest in how licensed or authorizing firms handle security failures.

Hypernative’s role is worth noting. Third-party monitoring firms increasingly surface suspicious activity in near real time, often before exchanges publish their own accounts.

The next updates from Mercado Bitcoin will need to answer the obvious questions. Where did the funds come from, how much was actually lost, and when can users move their money again.