Mercado Bitcoin

Is Mercado Bitcoin safe?

Mercado Bitcoin (MB) has a clean record on the thing that matters most: we found no hack that cost its customers money in more than a decade of trading. The catch is transparency. It publishes no proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary, its audited accounts are not online, and its central bank authorisation under Brazil's new crypto rules was still pending in October 2026. You are trusting a well-established private company more than you are checking it.

We score MB 63/100, below Bitso, which publishes a monthly proof of solvency, and well below Kraken and Coinbase, which both serve Brazilians and publish attested reserves or audited accounts.

Who runs Mercado Bitcoin?

The exchange is operated by Mercado Bitcoin Serviços Digitais Ltda. (CNPJ 18.213.434/0001-35), founded in São Paulo in May 2013 and owned by 2TM Participações, the holding company of the 2TM Group. The website now styles the same company as a "sociedade prestadora de serviços de ativos virtuais", the new legal category under central bank rules. MB says it has more than 4.5 million clients, and from October 2026 it is also taking over Bitso's retail customers in Brazil.

MB also runs a Portuguese arm for European clients. We did not find it on ESMA's register of MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary-licensed crypto firms.

Central bank approval: filed, not granted

Brazil passed its crypto law in 2022 (Lei 14.478) and gave the central bank the job of supervising exchanges. The rules (Resolutions BCB 519, 520 and 521) took effect on 2 February 2026. They require client assets to be kept separate from company money, set rules on custody, cyber security and anti-money-launderingAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary controls, and gave existing firms 270 days, until 30 October 2026, to apply for authorisation. Firms that apply in time can keep operating while the central bank reviews them, which can take years.

MB's website says it is in the process of authorisation as a virtual asset broker. That puts it inside the system but not yet approved. Once authorised, it will be one of the more tightly supervised exchanges in Latin America. Until then, licensing is MB's middle-of-the-road factor, not a strength.

No proof of reserves

After FTX collapsed in November 2022, most large exchanges published wallet snapshots or proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary. MB chose not to. It told InfoMoney that proof of reserves is limited because it "does not show that the assets match customer balances" and argued that legal segregation of client assets is the better safeguard.

That argument has some merit, and the new central bank rules now make segregation law. But segregation is only as good as the checks behind it, and MB offers customers no way to verify that their coins are covered today. Its security page says the accounts have been audited every year since 2018, by EY since 2022, and the homepage now mentions KPMG. We could not find the audited statements published. For the reserves factor that leaves MB well behind exchanges with frequent, attested proof that includes liabilities.

The CVM stop order

On 11 March 2025 Brazil's securities regulator, the CVM, ordered MB to stop intermediating 11 tokenised products (digital fixed-income and receivables tokens) that staff said were securities sold without the right authorisation. Staff also flagged possible crimes to federal prosecutors. Two weeks later, on 25 March, the CVM board accepted MB's appeal and revoked the order because it did not clearly say which assets were covered. The case went back to staff, who could propose a new order. We found no later sanction, but the question of whether MB may trade these tokens is not settled.

The 2013 "Bitcoin Rain" ruling

The oldest dispute dates from before the company existed. In early 2013 a family put 2,246 BTC into "Bitcoin Rain", an unauthorised fund promising 12% a month, run by one of MB's co-founders through the Mercado Bitcoin website. The co-founder later said a hack had wiped out the coins. A court-appointed expert found the hack never happened. In May 2023 a São Paulo civil court ordered MB, jointly with the co-founder, to return more than 2,000 BTC, then worth about R$300 million. MB argued it was not a party to the fund and said it would appeal. We could not confirm the outcome of that appeal.

How to use Mercado Bitcoin more carefully

1. Turn on two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary with an authenticator app and download the app only from the official stores. MB says it never contacts customers through WhatsApp or social media.
2. Keep only what you trade on the exchange. Without proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary, long-term savings are safer in a wallet you control.
3. Watch for the central bank's decision on MB's authorisation. A refusal or long delay would be a reason to move funds.
4. Remember that the FGC deposit guaranteeDeposit insuranceA government-backed scheme that repays bank customers up to a set limit if their bank fails, such as the FDIC in the US or the FSCS in the UK.More in the glossary covers bank deposits, not crypto or reais held at an exchange.

How we scored it

Security history (85) is MB's strongest factor: no known loss of customer funds to hackers since 2013. Reserves (45) is the weakest, because there is no proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary and no public audited accounts. Licensing (55) and custody (55) should rise if the central bank grants authorisation and MB publishes how it holds client coins.