Daily Brief

Web3 Daily Exploits — 3 Nov 2026: Mercado Bitcoin ~$46M Multi-Chain Signing Drain

Mercado Bitcoin confirmed a security incident on 2 Nov with ~$40–48.5M drained across 10 chains via signing access to hot wallets and deposit addresses. Exchange later stated ~$38–40M involved, pledged full customer coverage, and reported ~$11M frozen with partners. BTCPay Server hot-wallet sweeps on older versions traced to ~$1.63M (UPDATE). ZachXBT flagged suspected ~$133M EU entity exchange-account theft (unconfirmed). Live losses ~$46M across 1 scored incident.

Jacobo Avariento

Jacobo Avariento

— 12 min read
Web3 Daily Exploits — 3 Nov 2026: Mercado Bitcoin ~$46M Multi-Chain Signing Drain

The 3 Nov America/Panama window records one first-reported exchange incident used for scoring. Brazil’s Mercado Bitcoin confirmed a security incident early on 2 November UTC in which an attacker gained signing access to hot wallets and customer deposit addresses, draining an estimated $38M to $48.5M across at least 10 chains in plain transfers. On 3 November the exchange stated the assets involved were approximately $38–40M, pledged that customers would incur no losses, and reported that partners including Tether, Circle, Paxos, BRL1 and Chainalysis had helped freeze about $11M. Tether had earlier frozen more than $4.5M USDT. Separately, BTCPay Server hot-wallet sweeps on instances running version 2.4.1 or earlier, first reported late on 1 November, received an on-chain quantification of approximately $1.63M by Bitquery (UPDATE). ZachXBT raised a suspected theft from an unidentified EU entity’s exchange accounts from ~$106M to ~$133M with additional withdrawals (unconfirmed, no official victim or exchange statements; actor described as French-speaking and not Lazarus). The prior Binance ~$6.3B signing compromise remains an UPDATE. Combined live loss on this card is ~$46M for the newly scored Mercado Bitcoin item.

Mercado Bitcoin — multi-chain — ~$46M — signing access / hot-wallet and deposit-address drain

What happened: Early on 2 November 2026 UTC, Mercado Bitcoin identified and contained a security incident in one of its systems. Blockchain monitoring firms including Hypernative and Bitquery observed large outflows from wallets attributed to the exchange. The largest transfers occurred in a roughly 25–34 minute window around 06:19–06:53 UTC, with funds moving from hot wallets on Ethereum, Bitcoin, Solana, Tron, Polygon, Arbitrum, Avalanche, BNB Chain, Stellar and additional networks to fresh attacker addresses via plain transfers. The attacker also signed for customer deposit addresses; Bitquery reported approximately 35,853 Ethereum deposit addresses emptied, with activity continuing for hours after the exchange’s containment statement at 12:56 UTC. The exchange published destination addresses for tracking. No smart-contract exploit was identified; the method is consistent with unauthorized signing access (private-key or infrastructure compromise).

Protocol / chain / asset: Centralized exchange Mercado Bitcoin. Multi-chain: Ethereum, Bitcoin, Solana, Tron, Stellar, Polygon, Arbitrum, Avalanche and others. Assets included ETH, BTC, SOL, XLM, USDT, USDC, PEPE, AAVE, PENDLE and more than 200 other tokens. Customers were stated to be unaffected.

Loss: Initial Hypernative estimate >$40M. Bitquery investigation calculated ~$48.5M taken on 10 chains at the time. Arkham and contemporaneous reporting commonly referenced ~$46M held in attacker addresses. On 3 November the exchange stated the value of assets involved was approximately $38–40M and that about $11M had been frozen with assistance from Tether, Circle, Paxos, BRL1 and Chainalysis. Live scored figure used here is ~$46M (mid-range of reported estimates). Most remaining funds stayed in attacker wallets at cutoff; portions of ETH continued to move on 3 November.

Attack type: Signing access / infrastructure or key compromise leading to plain transfers from hot wallets and deposit addresses. Not a smart-contract vulnerability. Classic custodial hot-wallet exposure.

Explorer URLs: Main Ethereum attacker address: https://etherscan.io/address/0xe485e7a70b1131216cb47ca4555c4bbb2c742478. Bitcoin address holding ~106 BTC: https://mempool.space/address/19qGpsHvzh1t6pVi526XNNkh6hW6prDZp. Additional reported addresses include Solana 3YX6WHncP1Ra4AotE9YLawFt4nPmxyux288FWXkEW97J and Tron TEX3HuDRHRa3tnYpy96M4UfSx62VhDyA5L. Arkham entity: https://arkm.com/explorer/entity/mercado-bitcoin-hacker. Bitquery investigation: https://bitquery.io/investigations/mercado-bitcoin-hack.

Status: Exchange stated the incident was contained, no customer losses or data leak, and deposits/withdrawals (and later broader service access) paused as a precaution. On 3 November it pledged to cover the full amount so customers incur no losses and reported ~$11M frozen. Coordination with Tether, Circle, Paxos, Chainalysis and authorities ongoing. Attacker continued moving portions of ETH to new wallets on 3 November. Treat as confirmed drain of the reported multi-chain amount; exact total still ranges by source.

Sources: Mercado Bitcoin statements on X; The Block: https://www.theblock.co/news/defi/2026-11-02-mercado-bitcoin-hack-46-million-brazil-exchange-432333; Bitquery: https://bitquery.io/investigations/mercado-bitcoin-hack; CoinDesk 3 Nov coverage of coverage pledge and freezes; Arkham tracking posts.

Also noted

  • BTCPay Server hot-wallet sweeps on older versions (UPDATE, not re-scored as new): First reported late on 1 November 2026. BTCPay Server warned operators of unauthorized sweeps of hot wallets on self-hosted instances running version 2.4.1 (July 2026) or earlier. Attackers obtained admin access. Bitquery traced approximately $1.63M (18.38 BTC + 3,405 LTC across 682 sweeps) between 30 October and 2 November, with the bulk on 1 November and additional sweeps after the public alert. No credible reports on the latest 2.4.7 release. Official project advised shutdowns, updates and wallet replacement where access may already have been gained. Not a new first-report today. Sources: BTCPay official posts and blog; Bitquery investigation https://bitquery.io/investigations/btcpay-server-hack.
  • Suspected EU entity exchange-account theft (unconfirmed, not scored): On 2 November ZachXBT flagged a suspected loss of more than $106M from an unidentified European Union entity’s accounts at multiple centralized exchanges on 1 November, with funds withdrawn as USDC/USDT then swapped to ETH, sent through instant exchanges (WellWallet, Kyrrex), converted toward Monero and bridged. On 3 November he raised the estimate to more than $133M after identifying an additional ~$27M in withdrawals, some after his initial disclosure, and described the actor as French-speaking with on-chain overlap to cybercrime forum users (not Lazarus Group). Working theory is a large Western European financial institution, currently being covered up. No official confirmation from any victim, exchange or law enforcement. Flag as unverified. Cointelegraph and other coverage of the investigator’s Telegram updates.
  • Binance hot-wallet signing-access compromise (UPDATE, not re-scored): The ~$6.3 billion multi-chain drain from 29 October remains on prior briefs. Ongoing notes include further fund movements, freezes (including Arbitrum Security Council actions) and Binance statements on replenishment (~95%). No material new loss figures used for scoring today. Prior coverage: https://www.rektradar.xyz/web3-daily-exploits-30-oct-2026-binance-63b-eip7702-polymarket-debugbear/.
  • Prior items (not re-scored): PremiaLabs Arbitrum options vault, Troves, b14g, Name.com DNS/StepDrainer wave and earlier incidents remain as previously briefed. No material new loss figures used for scoring.
  • Monitored accounts: DefimonAlerts, CertiKAlert, Phalcon_xyz, GoPlusSecurity, SlowMist_Team, PeckShieldAlert, BlockSecTeam, Lookonchain, ZachXBT, CyversAlerts, Immunefi and rekt.news. No additional first-report protocol or smart-contract drains with fresh scored loss figures beyond the Mercado Bitcoin exchange incident.

Sources and references

Editor’s note: the scored live loss on this card is ~$46M. The newly reported item is the Mercado Bitcoin multi-chain signing-access drain. BTCPay Server is an UPDATE with a quantified figure from prior reports. The ZachXBT EU entity item is unconfirmed and not scored. Binance remains an UPDATE. No how-to or exploit reproduction steps. Stay tuned or stay rekt.

Read more

Web3 Daily Exploits — 1 Nov 2026: Premia $465K Arbitrum Options Drain, Troves 8.6 BTC Legacy Perm, b14g 97M CORE Zero-Withdraw

Web3 Daily Exploits — 1 Nov 2026: Premia $465K Arbitrum Options Drain, Troves 8.6 BTC Legacy Perm, b14g 97M CORE Zero-Withdraw

PremiaLabs vaults on Arbitrum drained ~$465K via empty option pools and flash-loan liquidity extraction. Troves xWBTC/WBTC vault on Starknet lost ~8.6 BTC through a legacy rebalancing contract that retained permissions. b14g dual-staking on Core lost ~97M CORE (~$1.47M) when zero-amount withdrawal requests were treated as full balances. Live losses ~$2.6M across 3 incidents. Binance remains an UPDATE.

By Jacobo Avariento
Web3 Daily Exploits — 30 Oct 2026: Binance ~$6.3B Hot Wallet EIP-7702 Takeover & Polymarket DebugBear Drain

Web3 Daily Exploits — 30 Oct 2026: Binance ~$6.3B Hot Wallet EIP-7702 Takeover & Polymarket DebugBear Drain

Binance hot wallets lost an estimated ~$6.3B across multiple chains after signing access was used to install an EIP-7702 delegation on Binance 14 and submit unauthorized withdrawals; ~$3B frozen. Polymarket international site lost ~$2.5-2.71M via a compromised DebugBear RUM script that abused logged-in sessions. Live loss ~$6.3B, 2 incidents, ETH · BTC · TRX · POL. zkLink Nova remains an UPDATE.

By Jacobo Avariento