Mercado Bitcoin's hot wallets and customer deposit addresses were compromised on November 2, 2026, resulting in $40–49 million in losses across 13 blockchains. Merkle Science traced the stolen funds and identified about $6.2 million in frozen stablecoins.
On November 2, 2026, attackers drained Mercado Bitcoin's hot wallets and swept funds from approximately 27,160 customer deposit addresses. Initial reports put losses at $40 million; investigations across 17 blockchains estimated $49 million. Merkle Science traced a single attacker-controlled address receiving assets on nine EVM networks: Ethereum, BNB Chain, Polygon, Arbitrum, Optimism, Avalanche, Linea, Base, and Cronos. Ethereum saw the largest losses at $29.6 million, followed by Bitcoin at $8.3 million and Solana at $3.5 million. Stablecoin issuers froze affected balances within hours: Tether blacklisted USDT and Circle froze USDC on multiple chains including Stellar. By November 2 at 16:20 UTC, approximately $6.2 million in stablecoins had been frozen. How the attacker accessed both hot wallets and customer deposit addresses remains unclear, but the coordinated activity points to a possible common vulnerability in Mercado Bitcoin's wallet infrastructure.