Mercado Bitcoin reported a security incident on November 2 and temporarily suspended deposits and withdrawals as a precaution. In a statement on X, the exchange said it had contained the incident and that customers had suffered no losses and no data had leaked. CNN Brasil (in Portuguese) also reported the statement.
A follow-up statement said the exchange was still working to restore operations safely. The Mercado Bitcoin X profile also shared destination addresses identified in transfers related to the incident across EVM networks, Bitcoin, Solana, Stellar and Tron to support monitoring and tracing. The statement specifies that the addresses are provided solely for identification and tracing, rather than as instructions to transfer funds.
The official status page showed partial disruption affecting the app, login, registration and trading API when checked. Those notices establish an operational impact, rather than its cause or the value of any affected assets.
For security teams, the question extends beyond how much may have left the wallets. What was detected, who received the warning and which control could stop further activity? These separate questions help assess the response without turning a hypothesis into a settled explanation.
An estimate is not a reconciled loss figure
BitNotícias (in Portuguese) attributed to Hypernative an estimate of more than $40 million in suspicious transfers from wallets associated with MB across several networks. The figure remains preliminary and should not be presented as Mercado Bitcoin's final acknowledged loss. The exchange's release of destination addresses adds tracing references; it does not independently confirm the total estimated by third parties or the attribution of every source wallet.
The exchange's financial exposure and the impact on customers are also different questions. Its statement about preserving customer balances does not, by itself, explain how much left its wallets or how much could be recovered. Reconciling those figures requires an account of both the operations and the identified transfers.
A recorded transfer and an explanation of how it was authorized are different kinds of evidence. Blockchain records can help follow assets; establishing the compromise requires additional information about the systems involved. The available reporting does not establish leaked keys, abused permissions or another specific entry point.
What AI could contribute to the defense
Hypernative describes its platform as combining transaction monitoring, machine learning and response mechanisms. That explains the supplier's technology; it does not establish which component generated the warning about MB.
The sources reviewed did not provide verifiable public evidence that the attackers used AI. They also do not establish that an AI defense blocked transfers, prevented losses or drove recovery in this incident.
The case nevertheless raises an operational question. A detection system may identify suspicious patterns across large datasets, but its practical value depends on the next step. Does the warning reach the right team? Is there a rule that can halt a transfer? Who can authorize services to resume, and what evidence must they review first?
Detecting a risk becomes protection only when a response can act in time.
This is an architectural and operational distinction, not a performance assessment of Hypernative's handling of this incident. Without a timeline of warnings and containment actions, declaring a particular technology successful or ineffective would be premature.
The next update needs to explain the failed control
A technical account could establish the affected system, the sequence of events, containment measures and reconciled asset figures. Service restoration should also be checked through official channels. Availability on its own does not certify that the investigation is complete.
The timing alongside the Binance and Chainalysis incidents, examined in a separate MnzAI Labs report, does not establish a shared campaign or entry point. Each incident needs its own evidence.
If you follow technology and security, look beyond the first number circulating on social media. Follow MnzAI Labs for explanations of how these attacks unfold, where AI can contribute and which controls need to turn a warning into protection.