Mercado Bitcoin halts deposits and withdrawals after incident
Mercado Bitcoin suspended deposits and withdrawals after a security incident, then published five destination addresses its own status page never listed.
On November 2, 2026, Mercado Bitcoin told clients it had identified and quickly contained a security incident in one of its systems during the early hours, and that deposits and withdrawals were temporarily suspended as protection. The official notice, posted at 12:56 UTC, said the incident left clients without a loss and left personal data unexposed. The freeze sits in that post, while the component list on the public status page names the website, registration, the trade API, the mobile app and login.
Four minutes earlier, at 12:52 UTC, an automated monitor opened major-outage flags for registration and the mobile app, then for login at 12:53 UTC and the trade API at 12:59 UTC. Each note says the monitor created the incident. At 19:32 UTC, 4:32pm in São Paulo, it marked all four components operational again after a little under seven hours. A desk that watched only that board would have seen the flags clear while the transfer suspension remained the instruction in the company thread.
What Mercado Bitcoin put on the record
The first post is a comunicado rather than a forensic report. Mercado Bitcoin wrote that it had "identificamos e contivemos com rapidez um incidente de segurança" in one system "nesta madrugada", its phrasing for a security incident found and contained in the early hours. From 9:56am in São Paulo the note suspended deposits and withdrawals while teams investigated, tracked assets and coordinated with the competent authorities. The affected system and any asset total stay out of the post.
A second post at 14:24 UTC, about an hour and a half later, said the firm was still working to restore operations safely and would update clients on official channels. It published the destination addresses it tied to the incident, limiting that on-chain notice to identification and tracking across five networks:
- Ethereum Virtual Machine (EVM): 0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478
- Bitcoin (BTC): 19qGpsHvzh1t6pVi526XNNkh6hW6prDZp
- Solana (SOL): 3YX6WHncP1Ra4AotE9YLawFt4nPmxyux288FWXkEW97J
- Stellar (XLM): GDXYRI6IONQA5YTGRLQ603FGJ2BWXPJTTQPUXFPSEXSRKBZLFKMZSOLP
- Tron: TEX3HuDRHRa3tnYpy96M4UfSx62VhDyA5L
Who else acted on the notice
Tether Chief Executive Paolo Ardoino quoted the notice at 15:06 UTC and wrote that Tether froze more than 4.5 million USDT related to the incident, a control separate from the deposit halt. Emmett Gallic, an on-chain analyst, wrote at 15:59 UTC that "lots of old deposit addresses are being swept by the hacker currently, while they sell off memecoins and altcoins," and linked an Arkham page. Mercado Bitcoin called the event a security incident and called the published strings destination addresses. Gallic also attached a dollar estimate in that post. The company notices leave any such total unstated, so the operating record is the suspension, the five addresses and the USDT freeze.
Why the status page cannot answer the desk
For a prime broker or a custodian using Mercado Bitcoin as a venue, the open question is which rail is available. Login, the mobile app, registration and the trade API can all read operational while deposits and withdrawals stay shut. The November 2 timestamps already show that split: the flags closed at 19:32 UTC, and the 14:24 UTC update was still about restoring operations. Early on November 3 the status summary still read up, which speaks to uptime rather than to the transfer halt. A follow-up on the company account is what would show which rails reopened.
Bank-owned stacks such as the Zodia Custody deal Standard Chartered has signed put the key holder outside the venue. An exchange that suspends its own deposits is both the venue and the wallet operator, so a status page that stops at login and the trade API leaves a monitoring gap. Issuer freezes are a second layer, the same family of control as a stablecoin that ships with clawback on the token, and a different failure mode from an exchange breach that spoofed approvals rather than keys. The notice leaves the failure mode unstated. What it states is that transfers are paused, five addresses are public, and coordination with the competent authorities is already underway.
The account profile describes Mercado Bitcoin as Brazil's largest platform for digital assets, the firm's own claim rather than an audited ranking. Clients received a Portuguese statement at 9:56am in São Paulo, an address list at 11:24am, a stablecoin freeze from Tether's chief executive, and four uptime incidents that covered components rather than the halt. Until a later post on that account names the rails, deposit and withdrawal status is a read of the November 2 thread.
This article is informational analysis only and is not financial, investment, or trading advice. Cryptocurrencies are highly volatile and can lose substantial value rapidly. Past performance and historical patterns do not guarantee future results. Do your own research and consult a regulated financial adviser before making any investment decision.
Reporting by Karthik Subramanian. Filed 3 November 2026, 10:31 GMT.
Digital Assets Correspondent
Karthik Subramanian is a founder, writer, and technology consultant with nine years in the crypto ecosystem.
