# Mercado Bitcoin Incident Highlights Different Risks in Exchange and DeFi

By Simon Yoon

Canonical URL: https://www.tokenpost.com/news/technology/47610
Published: 2026-11-03T11:47:30.000Z
Updated: 2026-11-03T11:47:30.000Z
Section: Technology

> At least $46 million moved from Mercado Bitcoin hot wallets across 10 or more blockchains. A second estimate put the amount at about $49 million across 17 blockchains.

Mercado Bitcoin’s Nov. 2 security incident involved wallets tied to the Brazilian exchange, while the available tracing does not identify a decentralized finance contract as the cause. The distinction separates exchange custody risks from permissions users grant to DeFi apps.

At 7:56 a.m. ET (12:56 UTC) Nov. 2, Mercado Bitcoin said it had contained an incident in one of its systems and paused deposits and withdrawals. The exchange did not identify the affected system or explain how access was obtained.

At least $46 million moved from Mercado Bitcoin hot wallets across 10 or more blockchains. A separate estimate put the total at about $49 million across 17 blockchains. The estimates cover different chain counts and remain unreconciled; they do not establish the exchange’s final net loss.

The first traced activity was on Base at 8:22 p.m. ET Nov. 1 (01:22 UTC Nov. 2). At 1:41 a.m. ET (06:41 UTC) Nov. 2, 104.43 Bitcoin (BTC), worth about $8.16 million at the time, moved from a wallet identified as belonging to the exchange.

The reviewed traces identify exchange wallets and attacker addresses. They do not show that a DeFi protocol or contract caused the incident. The exchange has not disclosed which system was affected or how the incident began, and the available estimates do not provide a complete loss accounting.

DeFi users face a different set of risks when they connect self-custody wallets to apps. A token approval gives an app permission to transfer approved tokens; an unlimited approval can allow access to a broader amount. Disconnecting a wallet from an app leaves existing approvals in place, so the wallet connection and token permission are separate.

Smart-contract code presents another risk. Ethereum transactions are generally irreversible, and deployed contract code typically cannot be changed to patch a flaw. Wallet interfaces may also show raw or incomplete transaction details, making it harder to tell what a signature authorizes. These are general DeFi risks, but the reviewed evidence does not connect them to the Mercado Bitcoin incident.