Mercado Bitcoin Freezes $11 Million After Hacker Drains Hot Wallets Across Multiple Chains
Mercado Bitcoin reported on November 2, 2026, that it had blocked approximately US$ 11 million in assets following a security incident detected in the early hours of that Monday.
The Brazilian exchange stated that it contained the breach rapidly and temporarily suspended access to services as a preventive measure. No customer losses or data leaks occurred, according to the official statement.
Reports indicate the attack targeted hot wallets, which remain connected to the internet for operational liquidity. The funds were dispersed across 17 networks, with the largest volumes moving on Bitcoin and Ethereum, and additional activity observed on Base, Tron, and Polygon.
Chainalysis tracked roughly US$ 4 million in stablecoins frozen in the first hours, with the total reaching nearly US$ 10 million. Arkham recorded 287 token swaps involving assets such as RENDER, WIF, KMNO, and POPCAT.
Estimates of the total volume varied: Mercado Bitcoin cited US$ 38 million involved with US$ 11 million already blocked, while Chainalysis estimated US$ 49 million and Bitquery calculated US$ 48.5 million passing through more than 35,000 Ethereum deposit addresses.
A director at Mercado Bitcoin contacted a Chainalysis specialist in Brazil at 2:30 a.m. Eastern Time and shared the list of unauthorized transactions. Investigators across three continents were mobilized, and authorities were notified within 30 minutes. Tether, Circle, Paxos, and the BRL1 consortium participated in the freezes.
The exchange confirmed it will absorb identified losses, coordinate with law enforcement, and restore services only when full security is assured.
Related articles
Scammer Leverages Unstoppable Domains to Redirect ATOM Transfers via Fake IBC Address
A journalist investigating a Telegram crypto investment pitch discovered an elaborate social engineering scheme that abused Unstoppable Domains. The scammer instructed the target to append -ibc.x to a shared Bybit XRP deposit address, causing the Edge wallet to resolve the string as a Web3 domain pointing to an attacker-controlled Cosmos address. The technique exploited Bybit’s shared deposit infrastructure and the wallet’s native support for Unstoppable Domains records. Analysis of the receiving Cosmos wallet showed 147 incoming ATOM transactions totaling more than 22,000 tokens between July and October. The author subsequently registered several .x and .crypto domains to demonstrate legitimate use of the same resolution mechanism in Edge, Trust Wallet, and OKX Wallet.
Binance Details Multi-Stage Social Engineering Attack Involving Fake Job Interviews and Malware-Laden Repositories That Resulted in $6.3 Billion Theft
Binance has disclosed new details about a sophisticated attack that allowed threat actors to steal $6.3 billion from the cryptocurrency exchange. The operation began when an engineer was contacted via a job platform by an individual posing as a project lead, followed by an interview conducted through a messenger with a supposed company executive. The fake company provided a test assignment hosted in a repository that contained actual malicious code, leading to device compromise. Attackers combined social engineering, developer tool malware, compromised endpoints, and artificial intelligence over several months. Binance executive Richard Teng stated that the incident cannot be reduced to a single employee mistake. The exchange and the FBI have attributed the theft to North Korean hackers, though North Korea denies involvement. Partners helped freeze nearly $3 billion, while Binance used corporate funds and insurance to replenish the stolen assets.
Lazarus Group Behind Record $6.3 Billion Binance Hot Wallet Theft: Anatomy and Cassandra Index Impact
Binance reported on October 29, 2026, that attackers stole approximately $6.3 billion in digital assets from its hot wallets, surpassing the previous record of $1.5 billion taken from Bybit in February 2025. The FBI attributed the breach to the TraderTraitor group, widely identified as the North Korean Lazarus Group, which has a history of high-profile operations including the 2014 Sony Pictures attack. The stolen tokens are being converted to Ethereum and laundered through decentralized finance platforms and instant exchangers. Binance covered 90 percent of losses using its SAFU fund, futures insurance reserves, and corporate treasury totaling around $6.34 billion, though this represents replacement of assets rather than recovery from the attackers. Blockchain analysis by TRM Labs linked the operation to prior campaigns against Bybit and KelpDAO through timing patterns and preparatory withdrawals via Tornado Cash. The incident contributed 2.3 percentage points to the Cassandra Index rise to 72, with the largest regional impact observed in East Asia.
Binance Confirms Record $6.3 Billion Crypto Theft via Compromised Hot Wallet and EIP-7702
Binance reported on October 30, 2026 that attackers stole approximately 6.3 billion dollars in cryptocurrency, equivalent to roughly 34 billion reais, marking the largest theft in the sector. The unauthorized transfers occurred on October 29 and were completed in about 20 minutes after the attacker compromised the system authorizing withdrawals. According to TRM Labs, the intruder leveraged Ethereum's EIP-7702 feature to seize control of a hot wallet following at least 36 hours of preparation. Initial reports pointed to a compromised DevOps engineer's laptop as the entry point, but the exchange later stated the incident involved multiple factors and was not a single-click action. Roughly 3 billion dollars have been traced, with Tether freezing over 1.57 billion USDT and Circle blocking more than 800 million USDC. Binance has committed to covering all losses through its SAFU fund and internal capital while cooperating with the FBI and U.S. Secret Service. Attribution remains disputed, with TRM Labs and Chainalysis linking the operation to the TraderTraitor group connected to Lazarus, though Binance has not confirmed the perpetrators.