Brazilian exchange Mercado Bitcoin temporarily suspended deposits and withdrawals after identifying a security incident in one of its systems. Tether said it froze more than 4.5 million USDT linked to the incident.
Brazilian crypto exchange Mercado Bitcoin said on November 2 that it had identified a security incident in one of its systems and temporarily suspended deposits and withdrawals as a precaution. The company said it had responded quickly that morning. As the investigation continued, Tether CEO Paolo Ardoino said the issuer had frozen more than 4.5 million USDT linked to the incident.
The exchange says customers suffered no losses
Mercado Bitcoin says customers suffered no losses and no data was leaked. The company did not accompany its statement with an independent incident audit. The exchange said its teams were investigating, tracing assets and coordinating with the relevant authorities.
The company did not identify the affected system, explain how unauthorized access occurred or disclose total losses. Although it said customers suffered no harm, it did not specify any loss to its own assets. It also gave no reopening time or completion estimate for individual pending transfers.
In a follow-up statement that day, the exchange said it was working to restore operations safely. It published destination addresses identified in movements associated with the incident under five headings: EVM, BTC, SOL, XLM and TRON. The exchange said it shared the addresses only to identify movements linked to the incident and trace assets. It did not ask customers to send funds to them.
EVM stands for Ethereum Virtual Machine. Several networks use compatible technology, so the five headings do not establish that transfers occurred on exactly five blockchains. The exchange did not disclose the amount sent to each address or how Tether’s frozen USDT was distributed among them.
No return of the frozen USDT has been announced
The amount in Ardoino’s November 2 post refers to more than 4.5 million USDT. USDT is Tether’s stablecoin designed to track the U.S. dollar. He did not present the amount as the incident’s total loss or as money already paid to customers.
In a separate freeze announcement dated April 23, Tether said it froze assets at identified addresses to prevent further transfers. Blocking an address’s USDT does not automatically reopen Mercado Bitcoin’s deposit and withdrawal services. The exchange says it is investigating its systems and working to restore operations safely.
Neither Mercado Bitcoin nor Tether announced that the frozen tokens had been returned to the exchange, distributed to customers or fully recovered. Ardoino also did not identify the networks and addresses covered by the freeze. The authorities working on the November 2 incident were not named either.
Status page lists outages in four services
Mercado Bitcoin’s official status page showed an ongoing partial outage on November 2. Four separate records, created by an automated monitoring service, marked the following components as completely unavailable and under investigation.
| Service | Record start (GMT+3) | Reported status |
|---|---|---|
| Account registration | 15:52 | Completely unavailable; investigating |
| Mobile app | 15:52 | Completely unavailable; investigating |
| Account login | 15:53 | Completely unavailable; investigating |
| Trading API | 15:59 | Completely unavailable; investigating |
Software uses an API connection to receive data from the exchange and submit transaction requests. The times in the table mark the start of monitoring records, not a confirmed start time for the security incident. KriptoMeta did not test account access, trading or transfers. Those records do not show when customers’ pending transfers will complete.
Customers can follow updates through the exchange’s official account and status page. Its help page directs signed-in users to the support button in the app or website. Users who cannot log in can use the help center or contact form. The support team replies to the form by email.
In the description of its October 1 security video, the exchange recommends downloading apps from official stores, typing the website address directly and using two-factor authentication. The chapter list places those habits at 3:20. The description also says staff will not ask users to install an app or share a password or recovery phrase. The earlier guidance helps users recognize phishing attempts; it does not explain the cause of the November 2 incident.
