Mercado Bitcoin Hack: What Happened?
The Mercado Bitcoin hack has put exchange security and a collection of stolen altcoins under scrutiny after researchers traced more than $46 million in crypto to addresses linked to the incident.
Mercado Bitcoin, a major Brazilian crypto exchange, said it identified and contained a security incident in one of its systems. The company temporarily suspended deposits and withdrawals while investigating, tracking assets and coordinating with authorities.
The exchange said customers suffered no financial losses and that there was no data leak. Those are the company’s statements; they should not be confused with an independent audit or proof that no exchange-controlled assets were moved.
Blockchain analytics firm Arkham identified transfers across at least 10 blockchains and estimated that at least $46 million was involved. Its analysis included Bitcoin, Ethereum, stablecoins and a range of smaller tokens. The exchange has not publicly confirmed Arkham’s total.
Why Is PEPE Part of the Story?
PEPE is one of several tokens researchers associated with the attacker’s holdings—not evidence that the PEPE project itself was hacked.
In a November 3 snapshot, blockchain tracker Lookonchain reported that addresses linked to the incident held approximately 372.99 billion PEPE, worth about $1.79 million at the time. It also identified holdings in AAVE, PENDLE, VIRTUAL, UNI and ONDO.
These figures describe an observed wallet snapshot. They can change if tokens are moved, sold or revalued as market prices fluctuate.
A large wallet holding can attract traders’ attention because a sale might create selling pressure. But a potential sale is not the same as a confirmed sale, and it would be misleading to attribute a PEPE price move to this incident without evidence.
Arkham reported sales of several smaller tokens linked to the attack. Its report did not establish that the PEPE balance identified in Lookonchain’s snapshot had been sold.
More Than $9 Million Reportedly Frozen
Lookonchain reported that more than $9 million in stolen assets had been frozen. Earlier, Arkham reported that Tether had frozen approximately $4.5 million in USDT linked to the incident.
The difference in figures reflects updates at different points in the response. They should not be added together: the later total may include assets counted in the earlier freeze.
A freeze can prevent certain tokens from being moved through an issuer’s controls. It does not automatically mean that the assets have been recovered, returned to Mercado Bitcoin or made available to customers. Recovery may require further investigation and legal action.
Not every crypto asset can be frozen in the same way. The response depends on the asset, its issuer and where it has moved.
What Remains Unknown?
Arkham described the attacker moving funds from exchange hot wallets, including substantial Bitcoin and Ethereum transfers. But Mercado Bitcoin has not publicly explained which system was compromised or how the attacker gained access.
That leaves several important questions open:
How did the attacker obtain the ability to authorize transfers?
What was the final value of assets affected?
How much of the frozen amount will ultimately be recovered?
When will deposits and withdrawals be fully restored?
What independent findings, if any, will be published?
The visible movement of funds is valuable evidence, but it does not by itself identify the person responsible or establish the full attack method. No group had been linked to the Mercado Bitcoin incident in Arkham’s report.
An Earlier Exchange Hack Shows Why Tracing Is Only the First Step
The Mercado Bitcoin incident follows other major exchange breaches in 2026. In September, Bitget reported a security incident affecting part of its wallet infrastructure and later estimated the loss at approximately $388 million.
As Bitnxt reported on the Bitget attacker’s cross-chain swaps, investigators could trace movements from Ethereum into Bitcoin, but seeing a transaction did not necessarily give them the ability to stop or reverse it.
The two incidents should not be assumed to share an attacker or an entry point. The comparison illustrates a broader problem: tracking stolen crypto and recovering it are different challenges.
Bitnxt Take: The PEPE Number Is a Snapshot; Custody Is the Bigger Story
The 372.99 billion PEPE figure is eye-catching, but the more important issue is how an attacker was able to move assets across several networks—and what safeguards will prevent a repeat.
For customers, Mercado Bitcoin’s assurance of no losses matters. So does a clear explanation of how balances were protected, what happened to affected assets and when normal services will resume. A frozen token balance, a credited customer account and a completed recovery are three separate outcomes.
The case also shows why exchange users should understand custody. A platform may use different wallets to process deposits and withdrawals, while the customer sees one account balance. Bitnxt’s earlier coverage of CoinDCX deposit-address issues examined a different incident, but raised a similar question: how effectively are operational wallets monitored and secured?
For readers considering their options, our guide to hot wallets versus cold wallets explains the trade-offs. Self-custody can reduce reliance on an exchange, but it also puts responsibility for protecting recovery credentials on the user.
What Should Mercado Bitcoin Customers Watch?
Customers should follow the exchange’s official updates for withdrawal status and avoid unsolicited messages offering “recovery” assistance.
The next meaningful updates would include a confirmed loss estimate, details of the investigation and a clear account of whether frozen assets have been returned. Until then, reported wallet balances and recovery figures should be treated as developing snapshots.
This article is for informational purposes and is not financial advice.
