Brazil's Biggest Bitcoin Exchange Says It Will Refund Users After a $40 Million Hack

Brazil's largest crypto exchange says its users won't pay for its hack. Mercado Bitcoin, which lost tens of millions of dollars on Monday, says the losses are its problem, not its customers'.

An exchange holds your coins the way a bank holds your cash, and when one gets robbed, the customers are often the ones left waiting to see what they get back.

The exchange spotted a breach early on November 2 and froze deposits and withdrawals. “We identified and quickly contained a security incident in one of our systems early this morning,” Mercado Bitcoin said in a Portuguese-language statement on X. “As a preventive protection measure, deposits and withdrawals are temporarily suspended.”

It said no customer lost money and no data leaked. It has not said how the attackers got in.

How much was taken depends on who is counting. Security firm Hypernative flagged more than $40 million in suspicious transfers across at least 10 blockchains, including Bitcoin, Ethereum, Solana, and Tron.

The exchange's own number is lower. “Right now the value of the assets involved is about $38 million,” Mercado Bitcoin said in a Portuguese-language update on X. “After a quick action with the crypto community and strategic partners, including Tether, Circle, Paxos, BRL1 and Chainalysis, we have already blocked $11 million.”

Others put it higher. Blockchain analysts at Arkham traced at least $46 million, while Chainalysis says about $49 million, with nearly $10 million frozen. The exchange has not said whether its $38 million includes the frozen amount.

Tether, which issues the USDT stablecoin (a token pegged to the dollar), froze more than $4.5 million in USDT tied to the incident, CEO Paolo Ardoino said on X.

A freeze only stops the tokens from moving. It doesn't return them to their owner, which is why the exchange's promise to cover losses carries the weight here.

On October 29, hackers drained more than $6 billion from Binance, the world's biggest exchange, and the FBI blamed North Korea's TraderTraitor group. Mercado Bitcoin has not linked its incident to that attack.

Binance made the same pledge as Mercado Bitcoin. “Binance will absorb the financial impact of the stolen funds, not our users,” CEO Richard Teng wrote on X, adding that about 95% of the affected assets had been replenished.

Neither promise can be checked from the outside. A guarantee to cover losses is only as good as the money behind it, and exchanges don't have to show customers their books.

For now, Mercado Bitcoin deposits and withdrawals remain suspended with no restart date. The exchange says it will post updates on X and resume service once full security is restored.