Brazil's largest exchange lost $46 million in an afternoon, self-hosted payment processors are being drained one merchant at a time, and spot Bitcoin ETFs shed another $398.6 million. Here is what broke over the last two days, and what it means for anyone holding or accepting crypto.
Mercado Bitcoin Loses $46 Million Across Nine Blockchains
Mercado Bitcoin, Brazil's largest cryptocurrency exchange, confirmed on November 2 that an attacker reached its hot wallet infrastructure and moved roughly $46 million in customer assets across nine blockchains, among them Bitcoin, Ethereum, Solana, and Tron. The exchange halted deposits and withdrawals within hours, said no customer lost funds and no personal data was exposed, and committed to absorbing the loss itself. It has not said how the attacker got in, or when withdrawals resume.
The response moved unusually fast. Chainalysis says it identified freezable addresses and reached law enforcement within thirty minutes, and Tether froze more than $9 million tied to the attacker. On November 3, Arkham tracked about $8 million in ETH moving to fresh attacker-controlled wallets. That early window is where most practical recovery happens. Once funds clear a mixer, the case shifts from asset tracing to claims against the custodian.
BTCPay Server Hot Wallets Drained Through an Unpatched Flaw
Reports surfaced around November 1 of Bitcoin and Litecoin draining from hot wallets on self-hosted BTCPay Server instances. The project confirmed the attacks on November 3 and said they use a different method than the LND credential-exposure flaw fixed in version 2.4.2 in August. Versions 2.4.1 and earlier are affected, with no credible drains on the current 2.4.7 release. Operators are told to upgrade and treat any compromised machine, and every secret on it, as breached.
The legal posture differs from an exchange hack. A merchant running a self-hosted processor is their own custodian, so there is no platform to pursue and no insurance fund to tap. Businesses that accepted crypto for clients should be looking at notification duties, contractual security representations, and whether the lost funds were theirs or someone else's. Those are separate questions with separate deadlines.
Liquid Network Finishes Restoring Its Bitcoin Reserves
On November 2, the Liquid Federation confirmed reserves back at 4,270.54 BTC, fully backing outstanding LBTC after four deposits totaling about 602.5 BTC closed the gap left by a September 6 exploit that minted roughly 4,000 unbacked LBTC through a cached range-proof flaw in Elements.
Worth being precise: this was a reserve replenishment, not a rollback or a court-ordered clawback. Direct federation withdrawals remain under enhanced controls, and promised governance changes have no timeline. For holders of wrapped assets, backing is a contractual and operational promise, not a technical guarantee.
ETF Outflows Push Bitcoin Below $76,500
Bitcoin traded near $76,456 on November 3, down 2.19% on the day and 3.59% on the week. Spot Bitcoin ETFs lost $398.6 million on November 2, following $643.3 million on October 30. Ethereum ETFs shed roughly $140 million, and liquidations neared $100 million. Weak tech equities and caution ahead of the U.S. midterms drove much of the move, alongside fallout from the Binance breach.
How to Protect Yourself
If you run your own payment infrastructure, patch BTCPay Server to 2.4.7 and rotate every key and credential that touched an older instance. Keep hot wallet balances small enough that a full drain is survivable. If you hold assets on an exchange, assume withdrawals can be frozen without notice and size your exposure accordingly. Holders of wrapped tokens should know who the custodian actually is, and what recourse the terms give them.
If you have already lost funds, speed matters most. Report the theft to law enforcement, notify the exchange or issuer in writing, and get destination addresses to a blockchain analytics firm. Stablecoin issuers do freeze assets, but usually only in the first hours. Preserve transaction records, support tickets, and timestamps. Depending on the facts, you may have claims against a custodian, a service provider, or an insurer, and sometimes a path to civil recovery.
At Coin Counsel, we work with individuals and businesses navigating the legal fallout of crypto fraud — whether you're a victim seeking recovery, a company facing regulatory scrutiny, or a project working to stay compliant in an increasingly complex legal landscape. The rules are evolving fast, and the cost of getting it wrong has never been higher. Contact us at coin-counsel.com to speak with a crypto-focused attorney today.
Disclaimer
This blog post is for informational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship between you and Coin Counsel or Franco Law PLLC. The legal landscape surrounding cryptocurrency is rapidly evolving and varies by jurisdiction. Do not act or refrain from acting based on information in this post without first consulting a qualified attorney. If you believe you have been the victim of crypto fraud, contact us at coin-counsel.com for a consultation.
