Mercado Bitcoin Sustains Over $40 Million Crypto Loss This Week

Exchanges and DeFi protocols across multiple blockchains reported significant security compromises between November 1 and November 5, 2026. While Binance reported record losses on October 29, several other high-profile incidents highlight vulnerabilities in both centralized exchanges and decentralized finance infrastructure.

Key Updates This Week

• Mercado Bitcoin reported over $40 million was transferred from exchange wallets following a security breach on November 2, 2026.
• DefiLlama reported 2026 losses reached $8.776 billion across 333 incidents as of November 8, 2026.
• The BTCPay Server vulnerability, exploited in 682 separate sweeps on November 1, was patched in version 2.4.2 in August.

Major Exchange Breaches

Mercado Bitcoin, Brazil's largest cryptocurrency exchange, paused its deposit and withdrawal services after attackers compromised a system on November 2, 2026. More than $40 million in crypto was transferred from exchange-associated wallets across various blockchains during the incident. Tether froze over $4.5 million of the stolen USDT following the breach.

Alongside this incident, BitMart reported a breach on the same day, November 2, 2026. Attackers successfully transferred approximately $391,000 from wallets on three blockchains: Base, Arbitrum, and Optimism. Blockchain investigators traced portions of these stolen funds to addresses associated with the concurrent Mercado Bitcoin exploit.

DeFi Protocol and Infrastructure Exploits

Several DeFi and self-hosted infrastructure services experienced targeted exploits during the week.

TENDRIL, a protocol, suffered an attack on November 5, 2026. An attacker exploited the token sell logic in a PancakeSwap V2 pool on BSC, draining roughly $550,000 in USDT. ExVul estimated the attacker’s campaign profit at no more than $181,910 USDT.

Loopscale Lending paused operations on Solana on November 5, 2026, following a sustained attack. The exploit involved more than 30,000 malicious API requests per day directed at its SOL and USDC Genesis Vault vaults. Loopscale stated that the affected vaults were made whole and no user deposits incurred losses.

Vulnerabilities in Self-Hosted Software

The BTCPay Server platform was hit by an exploit targeting version 2.4.1 and earlier on November 1, 2026. Attackers used the vulnerability to steal BTC and LTC from compromised self-hosted installations. Bitquery reported that this activity involved 682 separate sweeps, with 87% of the theft occurring in one wave between 14:12 and 22:16 UTC on November 1. Total funds stolen from hot wallets on outdated instances reached $1.62 million.

In a related security update, BTCPay Server released version 2.4.2 in August 2026, which addressed the vulnerability. However, the fact that the exploit continued to occur indicates that many installations were running outdated software.

Auth and Withdrawal Logic Flaws

Beyond exchange and protocol exploits, security gaps were noted in authentication and withdrawal mechanisms. Keplr wallets, when created using Google or Apple social logins, were targeted during November 2026. Attackers exploited Web3Auth's third-party authentication infrastructure to execute unauthorized transactions. In a separate incident, Premia V3 lost approximately $437,000 on Arbitrum on November 1 due to a flaw in its.