Nubank and Mercado Pago temporarily suspended cryptocurrency transfers on Friday, November 6. In a statement to the press, Nubank attributed the disruption in deposits and withdrawals to instability at an external data provider and said customer assets and information remained protected. In-app crypto purchases and sales were still available, Exame reported. Nubank tied the resumption of transfers to the provider's recovery and gave no timeline. Nubank statement reported by UOL, in Portuguese · Exame reporting, in Portuguese.
Was Nubank hacked?
At publication, a breach of Nubank itself had not been confirmed. The suspicion circulated after Paradigma Education shared an image attributed to the app on X and linked the outage to a possible attack on a provider. The in-app notice reported that crypto deposits and withdrawals were unavailable. Nubank placed the disruption outside its own infrastructure and had yet to name the provider or explain the technical cause. Early BitNotícias reporting, in Portuguese · Nubank statement reported by UOL, in Portuguese.
Chainalysis is a lead because Nubank has said it uses the company's technology to monitor blockchain addresses. In its own security incident, Chainalysis suspended transaction screening services and said at 5:30 a.m. Brasília time on Friday that it had begun restoring customer access in phases. The partnership and timing make the connection worth investigating. Public evidence has yet to link that service outage to Nubank's transfer suspension. Nubank partnership announcement, in Portuguese · Chainalysis update.
What Mercado Pago reported
An in-app notice reported by Agência Estado said cryptocurrency transfers were temporarily unavailable on November 6 and deposits could take longer to appear. Mercado Pago cited system instability. The sources reviewed do not confirm an attack on Mercado Pago or a shared cause with Nubank. Agência Estado reporting, in Portuguese.
What stops in the app and what happens on the blockchain
A crypto transfer passes through several stages. The app takes the request, the institution runs checks and authorizes the movement, and the network records the transaction once it has been submitted and validated. A check can fail before the transaction ever reaches the network. That is how a withdrawal can depend on a provider even while the blockchain is operating.
There is a different scenario. If someone gains unauthorized access to a wallet's signing service, the network can accept and record a transfer that follows its technical rules even though the institution never approved it. Public accounts of the recent Binance and Mercado Bitcoin incidents point to signing systems or operational wallets. Investigators used the networks' own records to trace assets in the Mercado Bitcoin case. That trail helps the investigation and, in certain circumstances, can support freezing some funds. Recovery requires further action. Binance's preliminary report · Mercado Bitcoin statement, in Portuguese · Tracing account.
Where AI figures in recent attacks
For the October 29 attack, Binance described fake job interviews, malicious code installed on a work computer and the use of an internal AI tool to reach other accounts and systems. Social engineering helped open the door. The AI tool came later, according to the exchange's preliminary investigation. Chainalysis reported agentic techniques in the attack on its own systems. The sources reviewed do not establish the use of AI in the attack on Mercado Bitcoin or in Nubank's service interruption. Binance's preliminary investigation · Chainalysis incident report · Mercado Bitcoin statement, in Portuguese.
Defenses need to keep pace with permissions
As AI assistants start operating tools, the risk grows with what those tools can do on someone's behalf. An assistant with code access, a token that can deploy software and a service that signs transactions may look like separate responsibilities. If permissions create a path between them, compromising one computer can reach a financial operation.
Teams building these systems can rehearse two distinct events. First, take the transaction screening provider offline and see which features stay available, what goes into a queue and what customers can see. Then simulate a compromised credential and test whether limits, alerts and independent approval can prevent a transfer. The result that matters is knowing where the operation can stop safely, before anyone has to trace the money.