Hackers Spark Chaos in Brazil's Crypto Market: Fintechs and Exchanges Halt Withdrawals (2026)

The first week of November 2026 was a scare for anyone holding crypto in Brazil. In a few days, Mercado Bitcoin — the country's largest crypto exchange — was attacked, and Nubank and Mercado Pago paused crypto operations. Social media filled with “the banks got hacked,” “AI attack,” “Pix is down.” Before panicking, it's worth separating fact from rumor — because the real story, if less cinematic, is more useful to anyone who needs to stay protected. This post explains what happened, what connects the cases, what's actually true about “AI attacks,” and what to do with it.

What happened during the week

Mercado Bitcoin: the confirmed attack

This is the concrete case. Early in the week (November 1–2), Mercado Bitcoin suspended withdrawals and deposits after a security incident. On-chain analytics firms say more than $46 million left the platform; the exchange didn't confirm the figure, but said it will absorb around $40 million in losses. The company stated the attack “did not harm customers” and there was no data breach — though unnamed experts disputed that, pointing to on-chain evidence of funds pulled from some customer wallets. Tether said it froze about $4.5 million, and other platforms another $2 million; Chainalysis is tracking the rest.

Nubank and Mercado Pago: the pause (and the rumor)

Here you have to be careful not to repeat a wrong headline. On Friday (Nov 6), Nubank suspended crypto deposits and withdrawals in Brazil, and Mercado Pago blocked some crypto transfers to external wallets as a precaution. Neither said it had been hacked: Nubank stated the problem is not in its infrastructure and that “assets and information remain protected”; Mercado Pago attributed the instability to an incident at a risk-monitoring and anti-money-laundering provider (which it didn't name). Notice what didn't happen: it wasn't Pix, it wasn't “the banks,” there's no confirmed loss of customer crypto. The link to a “hacker attack on a provider” came from a social-media post, with no source and without naming the provider. It may yet be confirmed — but so far it's a suspicion, not a fact.

And all of this happened a week after the largest crypto theft in history, the $6.3 billion Binance attack — which left the whole market on edge and helped turn every instability into a “new attack” headline.

What actually connects the cases

The lazy reading is “Brazilian banks got hacked.” The correct reading is different, and more uncomfortable: the common link is providers and crypto infrastructure, not each institution's vault. Mercado Bitcoin was hit directly; Nubank and Mercado Pago stopped because a third party in the path (a data, custody, or fraud-prevention provider) went unstable. It's exactly the pattern we saw at Binance and, before that, at Bybit: the attacker doesn't need to breach the final target — it's enough to compromise a link in the chain the target depends on. For anyone running a fintech, the right question isn't just “is my system secure?” but “how many providers does my operation depend on, and what happens if one of them goes down or gets breached?”

How to reduce provider risk

You can't audit every partner's code, but you can sharply limit the damage when one of them fails. The basics that separate a scare from a crisis:

1. Inventory your critical providers. List who touches money or sensitive data (custody, data, anti-fraud, payments), what permission each has, and where it plugs into your operation. You can't protect what you haven't mapped.
2. Least privilege for integrations. Cut broad OAuth scopes, tokens and API keys a provider doesn't truly need, and rotate credentials regularly.
3. Have a kill switch. Know, before the incident, how to quickly isolate or shut off a provider's connection — and test that procedure instead of discovering it on the day.
4. Monitor the integration's behavior, not just your app: anomalous “app-only” activity (no user) is one of the first signs of abuse.
5. Put limits on value flows. Destination allowlists, more-than-one-person approval and per-time-window limits keep a compromised provider from turning into unlimited withdrawals.

And this “AI” thing? What's real and what's hype

It circulated that the attacks were being carried out “with Grok, Claude and other AIs.” Here it's important to be honest: no public investigation has linked a specific AI product to these incidents. What does exist, and is documented, is a real trend — and it's serious enough without exaggeration. Mandiant (Google) tracks a financially motivated group, BREEZE COMET, that targets Brazil's financial sector — banks, payment processors, fintechs, exchanges — and uses generative AI and language models to write custom scripts: automating network scanning, credential checks, malware delivery and per-victim routing. AI here is an accelerator — it helps the attacker build tools faster and run campaigns against many targets at once. Initial access, though, stays mundane: password spraying, phone scams (vishing), remote-access tools installed by a fake “IT support,” aiming for credentials and certificates to issue transfers as if they were the company itself, including over Pix.

In other words: AI didn't invent a new kind of magic. It made cheaper and scaled up what the attacker already did. And that changes the defense math: if the adversary tests faster, with more creativity and against more targets, testing your own surface “once a year, by the book” stopped being enough.

How No Vuln thinks about this

This is where our approach fits, and it isn't a marketing line: No Vuln tests the way these attackers test. The same creativity (chaining small flaws until they become big impact), the same breadth (looking at the application, the integrations, the providers and the machine identities, not just the front door) and the same speed that automation gives the adversary today. The difference is the side of the table: a human researcher leads, deciding what's real risk, chaining the gaps and proving the impact — instead of handing over a list of scanner alerts. Technology speeds up the work; the judgment about what matters stays with the person.

In practice, it's that adversary's eye that finds the shortcut before the attacker does: the over-permissioned provider, the withdrawal flow that can be induced, the automation credential that becomes a back door. If your company moves money or data — fintech, payments, exchange, SaaS — talk to a researcher. And, more broadly, a periodic pentest, done with the mindset of someone who really attacks, is what turns “are we exposed?” into a concrete answer — before it becomes the next headline.

Sources: Bloomberg Línea, The Record (Mercado Bitcoin), Movimento Econômico and Cyberpress (on the BREEZE COMET group, tracked by Mandiant). Figures and attribution may be revised as investigations advance; as of publication, there was no official confirmation of a breach of Nubank's or Mercado Pago's systems, nor of a specific AI product being used in the attacks.