Days after the record 6.3 billion USD Binance hack, Brazil’s largest crypto exchange has become the latest casualty in a rapidly escalating wave of attacks against centralized trading platforms — and the industry’s emergency response playbook is once again being written in real time.
Mercado Bitcoin disclosed on Nov. 2 that it had identified and contained a security incident affecting one of its systems overnight. The exchange temporarily suspended deposits and withdrawals while investigating suspicious asset movements, but it insisted that customers suffered no financial losses and that no personal information was compromised. What the exchange did not disclose is how much the attack actually cost, or whether its own corporate reserves were hit.
Tether moves fast — and it is an investor
Tether CEO Paolo Ardoino confirmed that the stablecoin issuer froze more than 4.5 million USD in USDT linked to the incident. The move is notable for more than just its speed: Tether is a major investor in Mercado Bitcoin, having announced a 20 million USD strategic investment in July to support the exchange’s expansion into tokenization, payments, and other digital financial services.
The freeze is part of a broader, coordinated clampdown. On-chain analyst Specter reported that efforts involving security researchers and stablecoin issuers have now immobilized more than 9 million USD across nine digital assets, including USDC, PAXG, and RLUSD. The lesson for everyday investors is increasingly clear: when an exchange is breached, the first line of defense is no longer the exchange itself — it is the issuers of the stablecoins sitting in the attacker’s wallets.
46 million USD and counting
Blockchain analytics firm Arkham Intelligence identified approximately 46 million USD in cryptocurrency held by wallets attributed to the attacker, including 8.37 million USD in Ethereum, 8.24 million USD in Bitcoin, and 1.76 million USD in PEPE. Mercado Bitcoin has published the suspicious destination addresses across Bitcoin, Ethereum-compatible networks, Solana, Stellar, and Tron to support tracing and potential recovery efforts.
That transparency matters. The Binance investigation demonstrated that rapid address publication, combined with issuer freezes, can meaningfully constrain a thief’s ability to cash out. It also turns every subsequent transfer into evidence.
A brutal month for centralized custody
The Mercado Bitcoin breach comes less than four days after hackers stole a record 6.3 billion USD from Binance on Oct. 29. Before that, attackers siphoned 388 million USD from Bitget’s wallet infrastructure on Sept. 24 — losses the exchange absorbed with its protection fund.
The pattern extends further back. In early 2025, Bybit lost roughly 1.5 billion USD after hackers manipulated the transaction approval process for an Ethereum cold wallet, following a 69 million USD hot-wallet breach at Phemex in January. The FBI attributed both the Bybit and Binance thefts to North Korea’s TraderTraitor operation, showing how the same sophisticated actors repeatedly target centralized custodians. Investigators have not established any connection between those operations and the Mercado Bitcoin breach.
Different attack methods, same conclusion: the wallet-management, transaction-authorization, and internal-system layers that exchanges rely on to safeguard customer assets remain the industry’s weakest link.
What this means for your crypto
For everyday investors, the Mercado Bitcoin incident reinforces three practical takeaways. First, withdrawal suspensions after an incident are now standard procedure — the panic they cause is usually worse than the damage. Mercado Bitcoin customers were told they lost nothing, and stablecoin freezes suggest the attack may have targeted internal systems rather than customer funds directly.
Second, the industry’s freeze-first response is maturing. Tether, Circle, and other issuers now act within hours, and coordinated researcher efforts can lock down millions across multiple chains before an attacker can launder them. That is a structural change from even two years ago.
Third, concentration risk cuts both ways. Tether freezing funds at an exchange it invested in shows how entangled the industry’s biggest players have become — a single issuer now sits at the chokepoint of an ever-growing share of crypto’s emergency response. Whether that power is used to protect customers or for leverage is a question regulators have not yet seriously confronted.
The regulatory hangover
That last point is where this story is heading. The wave of 2026 breaches — Binance, Bitget, and now Mercado Bitcoin — has already revived debate over whether offshore exchanges need American oversight, and whether stablecoin issuers should have the unilateral power to blacklist wallets. Brazil’s regulators will face their own questions about how one of the country’s flagship exchanges was compromised and what disclosure obligations should apply.
For now, the immediate crisis at Mercado Bitcoin appears contained. But the longer trend is unmistakable: every major breach strengthens the case for stricter custody rules, faster issuer intervention, and — for the exchanges themselves — a hard look at whether the convenience of centralized custody is worth being the industry’s most popular target.
under ten percent of the haul frozen in the first hours and the trail goes cold fast after that. the freeze makes headlines, the mixer churn six blocks later makes nobody’s press release
6.3 billion at binance and then mercado loses a hot wallet days later, and we still get zero numbers on what it actually cost them. the no customer losses line is doing a lot of heavy lifting
4.5 frozen out of 46 means the rest is probably already moving through mixers. that window closes fast, doubt they catch much more of it
ardoino froze 4.5m in usdt within hours, impressive. but tether put 20m into mercado bitcoin back in july, so they are freezing their own portfolio here lol
after binance lost 6.3 billion every issuer is gonna freeze first and ask questions later, cant really blame them tbh
Tether freezing 4.5 million USDT within hours looks great until you remember they put 20 million into Mercado Bitcoin back in July. They are protecting their own investment as much as anyone’s customers.
Protecting their own 20 million investment and customer funds happened to align this once, Renata. The day those two interests diverge I know which one wins.
Hacker still walking around with 46 million and the exchange says customers lost nothing. That means the corporate reserves ate it. Brazil deserves a straighter disclosure than this.
Pedro you will get your straighter disclosure the same way we always do, in a quarterly filing nobody reads. the scary part is the 41.5 million that is NOT frozen and where it washes out
or insurance, pedro. could be a policy payout instead of reserves. either way we will learn the real number in a footnote six months from now
binance, now this. self custody week i guess
mercado suspended withdrawals overnight and by sunrise everything is fine again? binance at 6.3 billion, now this. hot wallet season, get your coins off exchanges
withdrawals resumed because the hole was plugged with reserves either way, that is the whole trick. customers see zero downtime, shareholders eat the loss, everybody calls it a win