# Mercado Bitcoin confirms security incident; deposits and withdrawals suspended Canonical: https://www.oktsec.com/radar/mercado-bitcoin-security-incident-november-2026 Publisher: Oktsec Language: en Published: 2026-11-02T17:21:02Z Updated: 2026-11-02T17:21:02Z Record reviewed: 2026-11-02T17:21:02Z Latest evidence check: 2026-11-02T17:21:02Z Disclosed: 2026-11-02 Mercado Bitcoin confirms a security incident and a temporary suspension of deposits and withdrawals. The provider says customers suffered no losses and no data leaked; those statements have not been independently established. ## Evidence and response priority - Category: Platform incident - Oktsec priority: Review this week - Rationale: The provider confirms an incident and a precautionary service suspension. Review operational dependencies this week; customers with pending transfers should check status now. No customer-side software flaw or patch is identified. - Evidence: Incident confirmed by provider - Verification: Vendor confirmed - Fix status: Not applicable - Exposure requirement: Application or configuration dependent - Vendor: Mercado Bitcoin - Products: Mercado Bitcoin deposits and withdrawals ## Technical overview On November 2, Mercado Bitcoin said it had identified and contained a security incident in one of its systems during the early morning. It temporarily suspended deposits and withdrawals as a precaution while investigating, tracing assets and coordinating with authorities. MB states that customers suffered no losses and that no data leaked. These are the provider’s statements; the two notices do not supply an independent assessment or a complete technical account of the incident. A second statement says work continues to restore operations safely and publishes destination addresses on EVM, Bitcoin, Solana, Stellar and TRON for identification and asset tracing. Publishing those addresses does not establish the amount lost, funds recovered or completion of restoration. The reviewed update does not announce that deposits or withdrawals have reopened. The reviewed official statements disclose no loss amount. This advisory therefore does not characterize a US$40 million theft as confirmed. Root cause, entry method, attacker attribution and an independently verified customer-impact assessment remain unresolved. For customers and organizations using MB, the immediate operational check is service availability and the state of pending transfers. Preserve transaction records, reconcile requests before retrying them and follow official status updates. No customer-side CVE, software patch or AI involvement is established by these statements. ## Recommended response Check the official service status before scheduling transfers, reconcile pending movements and track MB’s investigation and reopening notices. Relevant to: Mercado Bitcoin customers, treasury and operations teams, and organizations with transfers or workflows dependent on the platform. ## Response checklist 1. **Verify service availability through official channels** — Check Mercado Bitcoin’s current notices before initiating or scheduling deposits or withdrawals. The reviewed update describes restoration work, not completed reopening. Record the time and scope of any later service-status confirmation. 2. **Reconcile pending transfers and operational dependencies** — Record pending requests, transaction identifiers, timestamps and account statements. Review workflows that depend on MB availability, including automated retries. Confirm each pending request’s state before retrying it to avoid duplicate instructions. 3. **Use the official address list for investigation** — If you handle blockchain monitoring, compare relevant transaction records with the destination addresses published in MB’s second statement, retaining the network and source. MB published them for identification and tracing; a match alone does not establish attribution, total loss or customer impact. 4. **Track confirmed findings and verify support requests** — Keep the provider’s statements about customer losses and data separate from independently verified findings. Follow official updates on scope, cause and reopening. Verify unexpected recovery or support messages through established channels; never share private keys or seed phrases. ## Relevance to AI environments The reviewed statements do not establish AI involvement. Teams using automated transfer workflows should verify service availability and reconcile pending requests before resuming them. ## Sources - [Mercado Bitcoin official statement: security incident and precautionary suspension](https://x.com/MercadoBitcoin/status/2117239507263132056) — Mercado Bitcoin; Vendor notice; checked 2026-11-02T17:21:02Z - [Mercado Bitcoin update: restoration work and destination addresses for asset tracing](https://x.com/MercadoBitcoin/status/2117261565200146525) — Mercado Bitcoin; Vendor notice; checked 2026-11-02T17:21:02Z ## Editorial record - 2026-11-02T17:21:02Z: Added Mercado Bitcoin’s two November 2 statements, the temporary suspension and operational checks. Customer-impact assurances remain attributed to MB; no loss amount or completed restoration is established. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/mercado-bitcoin-security-incident-november-2026) · [Build a response plan](https://www.oktsec.com/radar/mercado-bitcoin-security-incident-november-2026#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=mercado-bitcoin-security-incident-november-2026&service=exposure_check) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.