-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 0xCERT Security Advisory 0xCERT-2026-0303 ============================================================ Advisory-ID: 0xCERT-2026-0303 Severity: Critical Published: 2026-11-02T12:56:49.000Z Updated: 2026-11-03T07:23:32.152Z Chains: Ethereum, Bitcoin, Solana, Polygon, Arbitrum, Avalanche, BNB Chain, Other / Multi-chain URL: https://www.0xcert.com/advisory/0xCERT-2026-0303 Title: Mercado Bitcoin suspends deposits and withdrawals after an estimated $40M+ drained from its wallets across 10+ chains Summary - ------- Brazilian exchange Mercado Bitcoin contained a security incident on 2 Nov 2026 after security firms reported more than $40M moved from its wallets across at least 10 chains. Deposits and withdrawals are paused; Tether froze 4.5M+ USDT. Screen the destination addresses published by the exchange. Details - ------- Summary Brazilian exchange Mercado Bitcoin said on 2 November 2026 that it had identified and swiftly contained a security incident in one of its systems overnight, and temporarily suspended deposits and withdrawals as a precaution. Security firms cited by CoinDesk estimate more than $40 million was moved out of exchange-associated wallets across at least 10 blockchains; the exchange has not confirmed an amount. Mercado Bitcoin later published the destination addresses identified in the incident-related transfers. Affected - - Mercado Bitcoin (centralized exchange) hot/exchange-associated wallets on Ethereum and other EVM chains, Bitcoin, Solana, Tron, Stellar and others - - No fix applicable; the exchange states the incident was contained Impact According to CoinDesk, the largest outflows occurred between 06:19 and 06:53 UTC and were plain transfers rather than a smart-contract exploit; how the attacker obtained signing access is not known. Mercado Bitcoin states customers suffered no losses and no data was leaked. Tether CEO Paolo Ardoino stated Tether froze more than 4.5M USDT related to the incident. No attribution has been published. Recommended actions - - Exchanges, bridges, OTC desks and stablecoin issuers: screen and flag deposits from the destination addresses listed in the indicators below. - - Mercado Bitcoin customers: follow only the exchange's official channels for the resumption of deposits and withdrawals, and beware of phishing that exploits the incident. - - Note: the Stellar address in Mercado Bitcoin's post (GDXYRI6IONQA5YTGRLQ603FGJ2BWXPJTTQPUXFPSEXSRKBZLFKMZSOLP) contains a character that is invalid in a Stellar address and is therefore not included as an indicator. Source & attribution This 0xCERT advisory summarises statements by Mercado Bitcoin (https://x.com/MercadoBitcoin/status/2117239507263132056 and https://x.com/MercadoBitcoin/status/2117261565200146525), reporting by CoinDesk (https://www.coindesk.com/business/2026/11/02/brazil-s-mercado-bitcoin-halts-withdrawals-after-usd40-million-drained-across-10-chains) and Tether's Paolo Ardoino (https://x.com/paoloardoino/status/2117272224814219720). Indicators are copied verbatim from Mercado Bitcoin's post. Details may change; refer to the original sources for the authoritative record. References - ---------- - - https://x.com/MercadoBitcoin/status/2117261565200146525 - - https://x.com/MercadoBitcoin/status/2117239507263132056 - - https://www.coindesk.com/business/2026/11/02/brazil-s-mercado-bitcoin-halts-withdrawals-after-usd40-million-drained-across-10-chains - - https://x.com/paoloardoino/status/2117272224814219720 - - https://www.blockchainbreaches.com/en/breaches/mercado-bitcoin-2026 Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc Fingerprint: 5F94 3ED1 1E50 CF31 2128 C493 CCC7 D9EC 9415 723D -----BEGIN PGP SIGNATURE----- wrsEARYKAG0FgmrqKyYJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp b25zLm9wZW5wZ3Bqcy5vcmdpUWepdOKpm9vzqD4f/7djr7IU08+4G3dWcDFC t8zGdBYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAAKeAD8CfJevKpn2EulnF4Z fjmXCyGn00r9mTw8eJwv8XpoOsgBAIwnGdxjmLuRMK9JYeCIkJp2y5le8x7K dVg3MTcgFwwC =Bm59 -----END PGP SIGNATURE-----