# Mercado Bitcoin Hot-Wallet Theft Reached as Much as $49 Million as Attacks on Exchange Back Offices Continue

Brazil's largest crypto exchange has only reopened in view-only mode, Binance says it has covered about 95% of its $6.3 billion loss, and an outdated card contract shows the same weakness further up the supply chain.

- Published: 2026-11-11T05:35:20.767Z
- Canonical: https://polylog.news/crypto/2026-11-11/mercado-bitcoin-hot-wallet-theft-reached-as-much-as-49-milli
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Rekt News (Mercado Bitcoin)](https://www.rekt.news/), [Rekt News (Binance)](https://www.rekt.news/), [crypto.news](https://crypto.news/crypto-debit-cards-shared-provider-risks/), [The Block](https://theblock.co/news/defi/2026-11-02-mercado-bitcoin-hack-46-million-brazil-exchange-432333), [Payment Expert](https://paymentexpert.com/2026/11/03/mercado-bitcoin-hack-chainalysis-help/), [Bitbo](https://bitbo.io/news/mercado-bitcoin-hack-40-million/), [Al Jazeera](https://aljazeera.com/news/2026/11/1/fbi-blames-north-korea-for-record-6-3bn-crypto-heist), [Cointelegraph](https://cointelegraph.com/news/fbi-blames-north-korea-for-record-63b-binance-hack), [Verichains](https://blog.verichains.io/p/rain-hack-analysis-ed25519-signature)

[Rekt News](https://www.rekt.news/) has published post-mortems on two exchange thefts from the past two weeks. In both, attackers emptied hot wallets through the exchanges' own operational systems rather than through a flaw in smart-contract code.

The more recent theft hit Mercado Bitcoin, which [The Block describes](https://theblock.co/news/defi/2026-11-02-mercado-bitcoin-hack-46-million-brazil-exchange-432333) as Brazil's largest crypto exchange, on November 2. The exchange put the loss at about $38 million. Analysts put it above $46 million, and Chainalysis estimated about $49 million moved across 17 blockchains. Security firms said the drain used [standard transfers](https://bitbo.io/news/mercado-bitcoin-hack-40-million/) rather than a contract exploit, which means the attacker controlled signing authority over the hot wallets. The exchange has not said whether that came from stolen keys or from the systems that authorize withdrawals. A Mercado Bitcoin director called Chainalysis at 2:30 a.m. Eastern time, and the firm contacted law enforcement [within 30 minutes](https://paymentexpert.com/2026/11/03/mercado-bitcoin-hack-chainalysis-help/). Roughly $10 million to $11 million was frozen with help from Tether and Circle. The exchange reopened in view-only mode on November 9 and says it will cover customer losses from its own reserves. Some analysts suspect a link to an earlier BitMart theft, which nobody has confirmed.

The Binance theft of October 29 is much larger. The FBI [attributed the $6.3 billion theft](https://aljazeera.com/news/2026/11/1/fbi-blames-north-korea-for-record-6-3bn-crypto-heist) to a North Korean unit it calls TraderTraitor. Cointelegraph [describes it](https://cointelegraph.com/news/fbi-blames-north-korea-for-record-63b-binance-hack) as the largest crypto theft on record. North Korea's state news agency called the claim "absurd rhetoric," and President Donald Trump said, "We don't know, we're looking at that." Binance says it has covered about 95% of the affected amount, and the rest consists of less liquid tokens.

The same pattern appears in payment providers that serve crypto brands. In August an outdated Solana card contract run by the provider Rain allowed a [signature-verification bypass](https://blog.verichains.io/p/rain-hack-analysis-ed25519-signature) that gave an attacker administrative control of card-collateral accounts and about $1.1 million. Ron Tarter, chief executive of MNEE App, told [crypto.news](https://crypto.news/crypto-debit-cards-shared-provider-risks/) that card brands hold little control over the upstream services they depend on.

## What this means

The exposed parties are exchange customers and the tokens that exchanges hold in quantity. A hot-wallet loss forces an exchange to choose between reserves, insurance and suspended withdrawals. Mercado Bitcoin's week-long freeze shows that the real cost to customers is lost access to their money, often more than lost principal. The market treats Binance's 95% reimbursement as proof that the system can absorb even a $6.3 billion loss. That holds only for exchanges with Binance's balance sheet. Mid-sized regional exchanges cannot cover a nine-figure loss, and stablecoin freezes reach only the share of stolen funds held in issuer-controlled tokens. As with Bybit in 2025, the pattern that is likely to repeat within weeks is more freeze requests aimed at issuers and more cross-chain laundering through assets no issuer controls. Over the following months, banking partners and regulators are likely to demand operational audits of withdrawal systems. Brazil's central bank is the authority to watch for Mercado Bitcoin. The read would be wrong if Mercado Bitcoin restores full withdrawals quickly and discloses a root cause limited to one compromised component.

## What to watch

- When Mercado Bitcoin sets a date for full trading and withdrawals and whether it repays balances in crypto or in Brazilian reais, which decides who carries the price risk on the stolen assets.
- Whether Brazilian regulators open a formal review of the exchange's custody controls, which would be the first test of the country's new crypto supervision rules after a major breach.
- Whether Binance's remaining uncovered balance, mostly less liquid tokens, gets paid in kind or in cash, because that affects token holders who may see forced selling.