Mercado Bitcoin Pledges Full Loss Coverage After $46M Signature Breach

Mercado Bitcoin confirmed a security incident on Monday, November 2, 2026, paused all deposits and withdrawals, and later pledged to cover every user loss after attackers drained an estimated $46 million using valid cryptographic signing credentials. The affected participants are the exchange's customers, who lost access to deposits and withdrawals during the pause, and the exchange itself, which now carries a loss-coverage commitment alongside the operational work of freezing assets and tracing wallets across at least ten blockchain networks.

The breach matters now because of how it was executed. Attackers did not need to forge signatures: they used valid signing credentials, so authorized and unauthorized transactions produced cryptographically identical signatures. That makes the breach architecturally undetectable at the blockchain layer until funds have already moved, which shifts the burden of detection onto exchange controls, key management, and post-incident tracing rather than on-chain validation.

What Mercado Bitcoin Confirmed and What Partners Froze

According to CoinDesk, Mercado Bitcoin pledged to cover all user losses after the near $40 million hack, and partners including Tether, Circle, and Chainalysis helped freeze $11 million of the stolen assets. The Block reported that Brazil's largest crypto exchange confirmed the security incident and paused withdrawals, and that Tether froze more than 4.5 million USDT linked to the attacker. Those freezes are concrete, verifiable actions taken by named counterparties, not general assurances.

Cointelegraph reported that the exchange paused deposits and withdrawals after the breach while saying customer funds and data were safe, and that customers suffered no losses. TechTimes added the mechanism: attackers used valid cryptographic signing credentials to drain wallets across at least ten blockchain networks. The exchange announced the suspension on X early Monday morning, saying it had "identified and swiftly contained a security incident in one of our systems," as Decrypt reported.

The confirmed changes, then, are the deposit and withdrawal pause, the $11 million freeze coordinated with Tether, Circle, and Chainalysis, the more than 4.5 million USDT frozen by Tether, and the pledge to cover user losses. The instrument at issue is spot custody of customer crypto balances held on a centralized exchange, not a derivative or margin product, so the relevant exposures are custody, counterparty, and operational rather than leverage or liquidation.

Why the Containment Claim and On-Chain Activity Diverge

TechTimes reported that independent on-chain investigators documented addresses linked to the breach continuing to receive and move funds for hours after Mercado Bitcoin said the incident was contained. That gap between the exchange's public statement and observed wallet activity is the central unresolved fact. It does not by itself prove the containment failed, but it does mean the public timeline cannot yet be reconciled with the on-chain record without the exchange's incident report and the investigators' underlying data.

Cointelegraph's reporting that wallets linked to the breach remained active after transactions were paused points in the same direction. The exchange's statement that customer funds were safe may refer to its own internal accounting and reimbursement position rather than to the security of the stolen assets themselves. Those are different claims, and treating them as one is where readers can misjudge the situation.

For customers, the operating impact during the pause was straightforward: deposits and withdrawals were unavailable, which matters for anyone relying on the exchange for liquidity or settlement. The loss-coverage pledge provides a financial backstop for balances, but it does not restore access until the exchange reopens those rails, and it does not by itself resolve how the credentials were compromised.

Risk Boundaries That Still Apply After the Pledge

A loss-coverage pledge reduces customer exposure to this specific event, but it does not remove the risks that surround centralized crypto custody. Price volatility still affects the value of any BTC or other balances while withdrawals are paused, because customers cannot reposition during the closure. Liquidity and spread conditions on the exchange may differ when rails reopen. Custody and counterparty risk remain with the exchange until balances are withdrawn or the remediation is completed and documented.

Network risk is also relevant given the ten-chain scope: tracing and recovery depend on each network's tooling and on the cooperation of stablecoin issuers and analytics firms. Stablecoin reserve and depeg considerations apply to the USDT-linked freeze, since the value of frozen tokens depends on the issuer's redemption mechanics. Regulatory and jurisdictional risk sits with the exchange as Brazilian authorities and partners assess the incident.

Operational-error risk covers the credential management failure itself, which is the root question the public record has not answered.

What a Source-Document Check Should Confirm Next

The exact loss figure needs reconciliation: CoinDesk cites nearly $40 million, while The Block, Cointelegraph, and TechTimes report $46 million. The difference may reflect the timing of freezes or asset valuation at the moment of the hack, but that is inference, not confirmation.

The full list of affected networks, described by TechTimes as at least ten, has not been published by the exchange, and the specific role each partner played in freezing the $11 million needs confirmation from official statements rather than secondary reporting.

The loss-coverage pledge also lacks a published remediation plan and timeline, so customers cannot yet verify how and when reimbursement will occur. Most importantly, the continued movement of funds after the containment announcement requires a direct explanation from Mercado Bitcoin. Until those documents are available, the withdrawal pause, the $11 million freeze, the Tether freeze of more than 4.5 million USDT, and the coverage pledge stand as confirmed, while the breach's full scope and the remediation mechanics remain open.

Readers holding balances should check the exchange's official status updates and their own account records before assuming access or reimbursement timing.

Reference

• https://www.coindesk.com/business/2026/11/03/mercado-bitcoin-pledges-to-cover-all-user-losses-after-near-usd40-million-hack
• https://cointelegraph.com/news/mercado-bitcoin-hack
• https://www.theblock.co/news/defi/2026-11-02-mercado-bitcoin-hack-46-million-brazil-exchange-432333
• https://www.techtimes.com/articles/329928/20261103/mercado-bitcoin-hack-drains-46-million-across-ten-chains-valid-signatures.htm