Mercado Bitcoin hot wallets drained in a hack worth tens of millions; the exchange is offline and says customers will not lose assets
Teaser from the source
Brazilian crypto exchange Mercado Bitcoin says it identified a security incident in the early hours of Nov 2 2026 that hit only its online hot wallets, not its offline cold wallets. It notified the authorities, suspended deposits and withdrawals and then took the platform temporarily offline, and says no customer data leaked and customers will not lose assets. In its Nov 2 evening update it said about US$11M had been blocked with help from Tether, Circle, BRL1, Paxos and Chainalysis, and about US$38M was still not blocked. Chainalysis, which helped trace and freeze funds, estimates about $49M was stolen across 17 blockchains, mostly Bitcoin and Ethereum. Crypto Times reports that Mercado Bitcoin later put the affected assets at about $36.3M with $12.9M blocked, and on Nov 4 Mercado Bitcoin said the platform will start reopening gradually via its website from Nov 9. The exchange has not said how the attacker got in. Bitquery says the same attacker address first drained about $391K, mostly from wallets tied to the BitMart exchange, starting 53 minutes before the Mercado Bitcoin drain, and BitMart's founder confirmed BitMart was also hacked on Nov 2.
This is the RSS-feed teaser. Read the full article at the original source.
Read at pwn.watchMore on customers
Other advisories
- HighCVE-2026-120554Carazo Import and export users and customers: fehlerhafte Autorisierung
- HighCVE-2026-120554Carazo Import and export users and customers: fehlerhafte Autorisierung
- HighCVE-2026-104368WebToffee Export and Import Users and Customers: unzureichende Kodierung von Ausgaben
- HighCVE-2026-104368WebToffee Export and Import Users and Customers: unzureichende Kodierung von Ausgaben
- MediumCVE-2026-54862Codection Import and export users and customers: Cross-Site-Scripting (XSS)
- MediumCVE-2026-54862Codection Import and export users and customers: Cross-Site-Scripting (XSS)
- Not ratedosv:CVE-2026-111629IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs
- MediumCVE-2026-17001Carazo Import and export users and customers: Cross-Site-Scripting (XSS)
Other news entries
- Chainalysis says hackers stole credentials and tokens for all of its customersNewsArs Technica — Security
- Veeam warns of Software Appliance boot failures on AMD EPYC hostsNewsBleepingComputer
- Chainalysis says breach exposed credentials for all customersNewsBleepingComputer
- Attackers turned OpsShield’s trusted update channel into a supply-chain attackNewsCSO Online
- DreamHost confirms data breach exposed FTP logins and webmail sessionsNewsBleepingComputer
- mSecure password manager hack prompts password reset warningsNewsBleepingComputer
- SonicWall warns of unpatched flaws in end-of-life GMS softwareNewsBleepingComputer
- mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious ActivityNewsThe Hacker News
Source: https://pwn.watch/i/mercado-bitcoin-hot-wallet-hack-nov-2026