# Brazil's Mercado Bitcoin Loses About $38 Million From Hot Wallets as ACryptoS and Ankr Suffer Smaller Exploits

ACryptoS lost about $665,000 across 77 vaults and is shutting down, an attacker reused a valid Optimism transaction to drain roughly $300,000 from Ankr's bridge, and Initia restarted after an unauthorized mint worth about $2.6 million.

- Published: 2026-11-10T05:42:11.659Z
- Canonical: https://polylog.news/crypto/2026-11-10/brazil-s-mercado-bitcoin-loses-about-38-million-from-hot-wal
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Rekt News (Initia)](https://www.rekt.news/), [Bloomberg Línea](https://www.bloomberglinea.com.br/crypto/mercado-bitcoin-sofre-ataque-hacker-de-us-40-mi-mas-descarta-perdas-para-clientes/), [Cointelegraph (Mercado Bitcoin)](https://cointelegraph.com/news/mercado-bitcoin-hack), [Tech Times](https://www.techtimes.com/articles/330280/20261109/acryptos-exploit-drains-665k-77-defi-vaults-project-says-platform-shuts-down.htm), [crypto.news (Ankr)](https://crypto.news/ankr-ethereum-bridge-exploit-303k-loss/), [The Crypto Times](https://www.cryptotimes.io/2026/11/09/ankr-bridge-hack-304k-drained-using-forged-cross-chain-receipts/), [Cointelegraph (Initia)](https://cointelegraph.com/news/initia-halts-blockchain-exploit-drained), [Cryptopolitan](https://www.cryptopolitan.com/initia-restarts-network-after-exploit/), [SlowMist](https://hacked.slowmist.io/)

**Mercado Bitcoin (centralized exchange, about $38 million).** Brazil's largest crypto exchange said attackers took about $38 million from hot wallets on November 2, across at least 10 blockchains. Cold storage was not affected. The company told [Bloomberg Línea](https://www.bloomberglinea.com.br/crypto/mercado-bitcoin-sofre-ataque-hacker-de-us-40-mi-mas-descarta-perdas-para-clientes/) that customers will not bear the loss. A later update from its help center put affected assets at about $36.3 million, of which $12.9 million had been blocked with Tether, Circle, Paxos, the issuer of the Brazilian-real stablecoin BRL1, and Chainalysis, according to [Cointelegraph](https://cointelegraph.com/news/mercado-bitcoin-hack). Some trackers estimate up to $49 million, a gap that probably reflects how assets spread across many chains are priced. Mercado Bitcoin has not disclosed how the attackers gained access to its signing keys.

**ACryptoS (yield aggregator, about $665,000).** On November 8, an attacker [drained 77 vaults on five chains](https://www.techtimes.com/articles/330280/20261109/acryptos-exploit-drains-665k-77-defi-vaults-project-says-platform-shuts-down.htm). The cause was a logic bug in share accounting. The vaults did not validate inputs, so a very small deposit minted most of the treasury's shares. The team disabled deposits, kept withdrawals open, offered the attacker a 10% bounty to return the funds, and said it will cease operations.

**Ankr Ethereum bridge (about $292,000 to $304,000).** Blockaid flagged the exploit on November 9 while it was still in progress. The attacker [reused one legitimate Optimism transaction](https://crypto.news/ankr-ethereum-bridge-exploit-303k-loss/) from November 3, so the bridge credited the same cross-chain deposit more than once. [The Crypto Times](https://www.cryptotimes.io/2026/11/09/ankr-bridge-hack-304k-drained-using-forged-cross-chain-receipts/) describes it as a drain using forged receipts. This is a replay failure in proof validation: the bridge did not record that the receipt had already been spent.

**Initia (layer-1 network and its rollups, about $2.6 million).** Initia halted its chain on October 23 after an attacker [minted unbacked tokens](https://cointelegraph.com/news/initia-halts-blockchain-exploit-drained) through a flawed function written in Move, its smart-contract language, and swapped them for assets on Ethereum. One linked address moved about 1,135 ETH. The network [came back online on November 2](https://www.cryptopolitan.com/initia-restarts-network-after-exploit/), and Cryptopolitan reports that the Initia Foundation covered the losses. One analyst blames a bug in the code that connects Initia's MoveVM smart-contract environment to its Cosmos SDK base, but Initia has not confirmed this. [Rekt News](https://www.rekt.news/) has published a write-up.

**Smaller incidents.** [SlowMist](https://hacked.slowmist.io/) logged about $112,300 lost from the InsurancePool and CoreVault contracts on BNB Smart Chain on November 3. BitMart lost about $391,000 from hot wallets on Base, Arbitrum and Optimism.

## What this means

Two of the four incidents follow the pattern this desk tracks: the Ankr bridge accepted a reused receipt, and Initia's chain allowed tokens to be minted without backing. In both cases, cross-chain verification created value that did not exist and pulled real assets out of a pool on the other side. Those exposed are the liquidity providers on the destination chain, who hold assets against claims that may be counterfeit. ACryptoS chose to shut down instead of raising money to rebuild, which supports the view that a single exploit now ends long-tail protocols, because the capital needed to restart them is not available. Mercado Bitcoin shows that stablecoin issuers and Brazilian-real stablecoin issuers can freeze about a third of stolen exchange funds within days. Native tokens remain out of reach. The likelier outcome over the next one to three months is more replay and mint failures on smaller bridges, and more small protocols closing after a single incident instead of compensating users. This read is wrong if a month passes in which DeFi losses come mainly from front-end or key compromises and not from verification logic.

## What to watch

- Whether Mercado Bitcoin discloses how attackers reached its hot-wallet keys. A third-party or legacy-system cause would match the pattern now seen at Binance and other exchanges.
- Whether Ankr publishes the exact check its bridge failed to perform. Other bridges that use the same receipt format would need to audit for the same replay gap.
- Whether ACryptoS recovers funds through its bounty offer. A return would show that negotiation still works against attackers who exploit small protocols.