Mercado Bitcoin paused its platform after an attack. The scam coming next targets users locked out of their accounts

In the early hours of Monday, 2 November, Mercado Bitcoin (MB) wallets were drained. According to Hypernative, the blockchain monitoring firm cited by Tecnoblog, most of the transfers took place between 3:19 and 3:53 a.m. Brasília time, to freshly created addresses. It came four days after the attack on Binance, which we covered here.

At 9:56 a.m., MB posted on X that it had identified and contained "a security incident in one of our systems," that clients suffered no losses and no data was leaked, and that deposits and withdrawals had been suspended "as a preventive measure." That evening, it said it had suspended "access to services." As of Tuesday the 3rd, the app remains unavailable.

What we know so far

• How much. In Tuesday's update, MB puts the affected assets at the equivalent of US$36.3 million, of which US$12.9 million has already been frozen. On Monday night, the figures were roughly US$38 million affected and US$11 million frozen, with help from Tether, Circle, Paxos, the BRL1 consortium and Chainalysis. Outside estimates run higher: Hypernative pointed to more than US$40 million leaving wallets tied to the exchange. The numbers measure different things, and MB's is the only one that nets out what has already been frozen.
• How. MB has not said how the attacker got in or which system was affected. Nor is there anything public so far linking the case to the Binance attack.
• What it means for clients. "Client assets are guaranteed," MB says, and "balances remain recorded in their respective accounts." On Monday night, the exchange had already said clients "will suffer no loss of assets." MB says it has notified the authorities, without specifying which.
• When it comes back. No date. The platform "remains paused until we are certain that resuming is safe." On Tuesday afternoon, MB said it intends to restore services "gradually," as each feature clears its security checks, and that "some operations" may come back before others. It promises to announce each stage in advance through official channels.

The scam coming next

App down, balance you can't check, withdrawals frozen and headlines about millions stolen. That's exactly the scenario a scammer waits for — and this time the target is Brazilian, gets the message in Portuguese and pays by Pix.

The expected playbook is the same one we described in the Binance case and in the recovery scam, only with MB's name on the front:

• a "Mercado Bitcoin support agent" who turns up on WhatsApp, by SMS or by phone, saying your account was hit by the attack;
• a request for your password, the code that arrived by SMS or the code from your authenticator app, "to validate your account";
• a link to download a "new app" or a "security update" from outside the official store;
• a notice that "your account has been released" or is "in the first phase of the restoration," with a link to log in;
• a link to "fast-track your withdrawal" or "unlock your balance," with a "fee," a "tax" or a "verification" Pix;
• a request to move your crypto to a "secure wallet" while the platform is down;
• a "recovery firm" claiming it can trace the attack and get back what you lost.

MB itself has already addressed nearly all of this. In Tuesday's statement, the exchange writes that it "does not contact clients asking for passwords, codes or transfers" and that clients do not need to "reinstall the app or switch devices." As of the afternoon of 3 November, across MB's statements on X, we found no request for clients to fill out a form, download another app, move funds or pay anything to get their assets back.

What to do while the platform is down

• Follow the official account only. Updates are being posted to @MercadoBitcoin on X. The return will be staged, and any "we're back" message that arrives with a link doesn't count: check the account and log in through the app you already have.
• Don't install anything. MB says there is no need to reinstall the app. If you reinstall anyway, use only the App Store or Google Play — never a link or file you received.
• Never share a code. SMS, email and authenticator codes exist to let you into your account. Whoever asks for one is trying to get into it.
• Don't pay to get paid. A fee, tax or Pix to "unlock" your balance is a scam, just as it was in the Binance case.
• If you've already fallen for it, call your bank immediately and request the Pix MED, file a police report, and keep the conversations and receipts. If the crypto is already gone, we explain what can still be done in Paguei por Pix e virou cripto.

In one line

MB says client assets are guaranteed and that it never asks for passwords, codes or transfers. Any message in Mercado Bitcoin's name asking for one of those three, for a new app, or for a fee to "unlock" your balance is a scam.

Got a message like this? Report it. Reporting won't recover your money, but it helps map who is running the scam and warns the next person in line.

Sources

• Mercado Bitcoin, on X — official statement (02/11/2026, 9:56 a.m.), evening update and figures and freezes (02/11/2026, 8:17 p.m.), 3 November status (03/11/2026, 12:17 p.m.), freezes and restoration plan (03/11/2026, 1:01 p.m.)
• Tecnoblog — Mercado Bitcoin pode ter perdido R$ 217 milhões em ataque hacker (02/11/2026), with Hypernative's estimate and timestamps
• Unchained — Brazil's Mercado Bitcoin puts security incident at $38 million, says clients won't lose assets (03/11/2026)
• Cryptoid — Ataques à Binance e ao Mercado Bitcoin ampliam alerta sobre segurança das corretoras de criptoativos (03/11/2026)
• CyberX — Ataque à Binance e o golpe que vem depois, Golpe da recuperação and Paguei por Pix e virou cripto