Mercado Bitcoin says $11.2 million in assets have been blocked following its November 2 security incident, according to a later company statement reported by CNN Brasil. The exchange says work to trace assets and restore operations safely is continuing.
In an earlier November 2 Bloomberg report, the company said it would absorb a $40 million loss and did not expect customer losses. The report cited a company text message saying the attack targeted hot wallets and was quickly contained. That loss-cover pledge should be distinguished from the developing recovery figures.
The later company update reported by CNN Brasil put assets still involved at about $38 million. That remaining-impact figure, the amount blocked and the estimated gross theft measure different things. None should be presented as an independently audited final loss.
What did Mercado Bitcoin confirm?
In its initial official statement, Mercado Bitcoin said it had identified and contained an incident in one of its systems overnight. It said customers had suffered no financial harm and that no data had leaked. Deposits and withdrawals were paused as a precaution while teams investigated, traced assets and coordinated with the authorities.
A follow-up statement said work to restore operations safely was continuing. The company also published destination addresses associated with the incident on EVM-compatible networks, Bitcoin, Solana, Stellar and Tron. It explicitly described those addresses as being for identification and tracking—not as destinations for customer deposits.
Why do the reported dollar figures differ?
Chainalysis’s own response account estimates that approximately $49 million was stolen across 17 blockchains. The company says Mercado Bitcoin called it in to help investigate and that its work helped freeze nearly $10 million. Those are the recovery partner’s estimates and account of its intervention, not a separate loss to add to the exchange’s figures.
Valor also reported about $49 million diverted and $11.2 million blocked. Differences in timing, coverage and what each number measures matter. A pledge to absorb the financial impact is not proof that every stolen asset has been recovered or every withdrawal route is available.
What does Tether’s freeze establish?
An earlier statement from Tether chief executive Paolo Ardoino reported more than 4.5 million USDT frozen. Freezing restricts movement of tokens; it does not by itself establish that the money has been returned. Issuer, investigator and company freeze reports should not be added together without first establishing whether their scopes overlap.
The freeze amount should therefore not simply be subtracted from a reported loss to produce a supposedly confirmed net-loss figure. Recovery, loss coverage and the restoration of account services are separate milestones.
When will Mercado Bitcoin withdrawals return?
The November 2 public statements linked above did not provide a firm reopening time. They said deposits and withdrawals were temporarily suspended and that further updates would come through official channels. A commitment to cover losses is not a withdrawal-restoration announcement.
Users checking availability should rely on the exchange’s official service notices and their own account interface, rather than a third-party wallet estimate or a social-media promise to recover funds. The linked public notices also do not explain how the attackers obtained access; a detailed technical account should not be inferred from the fact that hot wallets were involved.
Related: Our BTCPay Server wallet-drain report covers a separate security warning affecting older software versions.
Updated November 3 with the later company figures reported by CNN Brasil and Valor, and Chainalysis’s response account. Estimates and service availability may change.
