On November 2, 2026, wallets attributed to Mercado Bitcoin began sending funds to fresh attacker addresses across ten chains. The bulk of the outflows came in a fast multichain sweep between 06:24 and 06:49 UTC, when wallets on every chain sent most of their balances, and the exchange's Bitcoin deposit addresses were swept to the same attacker from 02:15 UTC. Mercado Bitcoin puts the value still in the attacker's wallets at around $38M, with more than $11M already blocked, about $49M in all.
Every transfer was a plain, valid signature from Mercado Bitcoin's own wallets, and how the attacker obtained that signing access is not yet known.
At a glance
- Loss (gross): $49M
- Detected and priced live: Hypernative's hot-wallet compromise detection priced about $12.2M of the drain in real-time, across Ethereum, Polygon and Arbitrum, within seconds of each block.
- Chains: Bitcoin, Ethereum, Tron, Solana, Stellar, Avalanche, Polygon, Arbitrum, BSC and XDC.
- Receiving addresses: One EVM address reused across the EVM chains, plus separate Bitcoin, Solana, Tron and Stellar receivers. The funds have since fanned out to many downstream wallets.
- Still in attacker wallets: About $38M, the ~$49M gross minus the more than $11M already blocked by issuers. Much of it sits in volatile tokens the attacker is swapping.
- Frozen by issuers: More than $11M has already been blocked, confirmed by Mercado Bitcoin: about $5.5M in USDT (Tether), about $4M in USDC and EURC (Circle, including a Stellar freeze), about $1M in PAXG and USDP (Paxos), and BRL1 on Polygon.
- Drain window: Bitcoin from 02:15 UTC; the multichain sweep 06:24 to 06:49 UTC, on November 2, 2026.
- Root cause (as understood onchain): Plain signed transfers from Mercado Bitcoin wallets, which points to a compromise of the exchange's signing access rather than any contract flaw. How the access was obtained is not yet known.
Timeline (UTC, 2 November 2026)
- Nov 1, from 18:06: The attacker sets up new wallets; first small deposits arrive in them (BSC, Ethereum, Tron)
- Nov 2, 02:15 - 02:30: Attack on Mercado Bitcoin starts: Bitcoin taken from Mercado Bitcoin deposit addresses, 0.37 BTC (~$29K)
- 06:19: Main attack begins: More Mercado Bitcoin deposit addresses emptied, 1.27 BTC (~$99K)
- 06:24 - 06:49: In 25 minutes, funds are taken from Mercado Bitcoin wallets on 9 more blockchains (Ethereum, Tron, Solana, Stellar, Avalanche, Polygon, Arbitrum, BSC, XDC). Largest on Ethereum 2,852 ETH (~$6.5M)
- 06:41: Biggest single transfer: 104.43 BTC (~$8.16M) taken in one Bitcoin transaction
- 10:21: First freeze: The attacker’s USDT on Polygon is frozen
- 11:37 - 11:38: Tether blocks the attacker’s USDT on Tron and Ethereum
- 12:07: The attacker starts moving the stolen funds to new wallets
- 12:57: Mercado Bitcoin announces the incident and temporarily pauses deposits and withdrawals; says customers lost nothing and no data leaked
- 14:28: Paxos freezes the attacker’s PAXG and USDP
- 14:55: Tether freezes the attacker’s USDT on Solana
- 15:07: Tether CEO says more than 4.5M USDT has been frozen
- 23:17: Mercado Bitcoin confirms more than $11M blocked with Tether, Circle, Paxos and BRL1, and puts the assets still involved at about $38M
How the attack worked
Every outflow was a plain signed transfer. The Ethereum drain (0xf447ad51…) was a bare ETH send with no contract call: 2,852 ETH straight from a Mercado Bitcoin wallet to the attacker. The same shape repeated across the other chains: Mercado Bitcoin's own wallets signed their balances away to one set of attacker addresses in a tight window. There was no malicious contract, no delegation, and no exploit of any protocol.
An attack that moves funds from that many independently keyed wallets, across five different chain types (Bitcoin, Solana, Stellar, Tron, and EVM), points at the exchange's signing infrastructure rather than any single leaked key. How the attacker obtained signing access is not yet known. This is the shape most large exchange losses have taken through 2026: a compromise of the signing path rather than a contract bug, as in the Binance hot-wallet drain days earlier and the signer compromises before it.
What Hypernative saw
When the wallets began moving, hot-wallet compromise detections fired in real-time across Ethereum, Polygon and Arbitrum as they were swept, pricing about $12.2M of the theft within seconds of each block, and we issued early alerts to subscribed customers. We continued to trace the funds across all ten chains as the attacker consolidates, bridges, and swaps them.
Where the funds are
The stolen funds first landed in a small set of attacker addresses, then began moving from about 12:07 UTC. The attacker has split funds across new hop wallets and, onchain, appeared to have bridged and swapped value across chains, including toward Solana. About $38M still sits in the attacker's wallets and remains traceable.
Issuers have already blocked more than $11M of the stolen funds, which Mercado Bitcoin confirmed. Hypernative traced those freezes onchain: roughly $5.5M in USDT (Tether), about $4M in USDC and EURC (Circle, including a Stellar freeze), about $1M in PAXG and USDP (Paxos), and BRL1 on Polygon. The Solana USDT and the Stellar USDC are both marked frozen at the account level. Assets with no issuer, such as ETH and BTC, cannot be frozen that way, which is why the Bitcoin taken from Mercado Bitcoin’s deposit addresses is not recoverable through an issuer.
How exchanges can prevent a hack
The moment to stop a drain is after a transaction is created and before it's signed. Each transfer in this attack was initiated in Mercado Bitcoin's systems and then signed by its own wallets, likely through automated signing built for speed. Once signed and broadcast, a transfer can't be reversed.
Hypernative’s Transaction Guard prevents exchanges and institutions from signing malicious or nonstandard transactions:
- Signal: every transaction and message initiated from the organization's wallets or signing infrastructure is sent to Hypernative before signing.
- Detection: Hypernative interprets what the transaction will do and identifies potential risks. Two detections apply directly to this attack:
- Recipient risk: Hypernative profiles each recipient's history and its relationship with the organization. In this attack, every recipient had been created hours earlier and had never transacted with the exchange.
- Behavioral deviation: Hypernative learns each wallet's normal activity and flags operations that significantly deviate from it, even when the change builds up over several transactions rather than in one.
- Policy: Hypernative's built-in detections are combined with the organization's own custom rules.
- Enforcement: denied transactions are rejected automatically in the wallet before signing. Warnings can require additional approvers.
Automated signing stays fast but won't sign a transaction that fails the organization’s policy.
How asset managers working with exchanges can stay safe
Transaction Guard sits on the exchange's side and stops a key compromise before a withdrawal is signed. If you are an asset manager or treasury holding funds on that exchange, Onchain Monitoring is your control.
If an exchange is compromised, the first sign is an abnormal outflow from its hot wallets, and Hypernative’s detection engines flagged this one within seconds of the first blocks. Paired with an automated response, that alert can trigger an action immediately: withdrawing their own balance from the exchange. Seconds are the timescale that matters, because a drain can empty a wallet in a single block, and the customers who pull their funds first are the ones who get them out. You can learn more about how Onchain Monitoring & Automated Response helps during signficant events through our case study with Wave Digital Assets who came out intact following 2025's flash crash and how KPK used Hypernative to automatically exit their positions following the Binance hack, being the first to exit in affected markets and the only identified asset manager to fully close its carry trade positions that night.
How institutions and protocols can keep stolen funds out
After a drain, the next job is to keep the stolen funds from re-entering the system. That falls to the counterparties an attacker needs in order to cash out, swap or borrow: financial institutions, protocols, pools and liquidity providers. As the attacker spreads the stolen funds, the same monitoring traces every new address, so exchanges and custodians downstream can screen and block inbound deposits from them.
Hypernative's Screening & Intelligence checks every incoming address in real-time, before funds are credited, so clean deposits are accepted as normal and tainted ones are held before they land. Real time is the point. Stolen funds move fast and split across addresses and chains, so the exposure data has to update as they move; a batch or daily refresh misses them.
Flagged deposits are quarantined, kept out of operational wallets until they are reviewed so they never mix with clean balances. The same screening applies to DeFi collateral, since stolen funds are often posted to borrow clean assets, which means lending protocols and pools need it on everything they accept.
What to do now
The controls above map to where you sit: Transaction Guard before signing for exchanges and custodians, Onchain Monitoring and automated response for asset managers holding funds at a venue, and Screening & Intelligence on inbound addresses for the institutions, protocols and pools that could receive the stolen funds.
About Hypernative
Hypernative is the proactive onchain security platform for enterprises and institutions. We predict and neutralize digital asset threats before they materialize, unifying real-time monitoring, transaction security, fraud prevention, compliance screening, and automated response in a single, institutional-grade platform. Powered by the most battle-tested machine learning engine in digital asset security, Hypernative has actively prevented over $3 billion in losses across 75+ blockchains, all verifiable onchain. Trusted by 350+ leading organizations including top financial institutions, exchanges, asset managers, protocols, and chains, Hypernative provides the security infrastructure that gives enterprises and institutions the confidence to operate and scale in the onchain economy.
Reach out for a demo of Hypernative's solutions. Hypernative's blog and our social channels to keep up with the latest in onchain cybersecurity.
