Mercado Bitcoin Bleeds $40M as Hackers Tear Through Crypto in One Brutal Week

Mercado Bitcoin slammed the brakes on deposits and withdrawals on November 2, 2026, after attackers slipped into one of its systems. More than $40 million in crypto walked out of exchange-linked wallets spread across multiple blockchains. Tether stepped in fast, freezing over $4.5 million of the stolen USDT before it could vanish further.

The same day, BitMart got hit too. Attackers moved roughly $391,000 out of wallets on Base, Arbitrum and Optimism. Blockchain sleuths traced chunks of that money to addresses tied to the Mercado Bitcoin exploit, suggesting one crew may have been working both targets at once.

DeFi took its own lumps. TENDRIL got picked apart on November 5 when an attacker abused the token sell logic in a PancakeSwap V2 pool on BSC, draining about $550,000 in USDT. ExVul pegged the attacker's actual campaign profit at no more than $181,910 USDT. Over on Solana, Loopscale Lending paused operations the same day after fending off a sustained barrage of more than 30,000 malicious API requests per day aimed at its SOL and USDC Genesis Vault vaults. Loopscale said the affected vaults were made whole and no user deposits took a hit.

Self-hosted setups weren't safe either. BTCPay Server got exploited through a flaw in version 2.4.1 and earlier, with attackers lifting BTC and LTC from outdated installations. Bitquery counted 682 separate sweeps and found 87% of the theft landed in a single burst between 14:12 and 22:16 UTC on November 1. Hot wallets on old instances lost $1.62 million total. The kicker: BTCPay shipped version 2.4.2 back in August 2026 to patch the hole, meaning plenty of operators simply never updated.

Authentication and withdrawal rails had holes too. Keplr wallets created through Google or Apple social logins were targeted during November 2026, with attackers abusing Web3Auth's third-party authentication infrastructure to fire off unauthorized transactions. Separately, Premia V3 lost roughly $437,000 on Arbitrum on November 1 thanks to a flaw in its system.

Stack it all up and the first five days of November 2026 delivered a brutal tour of crypto's soft spots — centralized exchanges, DeFi pools, lending vaults, self-hosted software and even social-login wallets. The thread running through several of them: known vulnerabilities and unpatched software that someone, somewhere, never got around to fixing.