Two Digital Banks Just Paused a Product Line Because One Vendor Went Down: The Concentration Risk Case
TL;DR
On 6 November, Nubank suspended crypto deposits and withdrawals, while Mercado Pago restricted transfers to external wallets. Both said customers’ assets were safe and their own infrastructure was not compromised.
Nubank uses Chainalysis KYT for transaction screening. Mercado Pago cited instability at its AML and risk-monitoring provider, but neither company publicly confirmed that the same vendor caused both disruptions.
The operational lesson is clear: when a critical compliance service has no effective fallback, vendor downtime can become a product outage.
Payment operators need tested contingency plans, contractual resilience commitments, prompt credential rotation and clear customer communications.
Two digital banks restricting crypto payments in the same week is more than an incident report. It is a practical demonstration of third-party risk: a business can maintain its own systems and still be unable to offer a product when an essential external service is unavailable.
The precise vendor connection needs careful wording. Nubank uses Chainalysis KYT to screen crypto transactions for money laundering, and reporting linked its pause to the Chainalysis service disruption. Mercado Pago said its risk-monitoring and anti-money-laundering provider was unstable but did not name it. The two companies did not publicly confirm that the incidents had a common cause. Even with that caveat, the case raises an urgent question for fintechs and payment firms: how much of a product depends on one compliance provider?
What did Nubank and Mercado Pago pause, and why does it matter?
Both companies restricted crypto movements from 6 November after disruption at external providers, but the restrictions were not identical. Nubank suspended crypto deposits and withdrawals while leaving internal buy and sell functions available. Mercado Pago restricted some transfers to external wallets and said incoming deposits could be delayed.
Nubank said the incident was outside its own infrastructure. Mercado Pago attributed its disruption to an incident at a supplier responsible for risk monitoring and anti-money-laundering prevention. Both communicated that customer assets remained safe; neither provided a confirmed date for the full return of service.
This distinction matters. A vendor outage does not automatically mean customer funds are exposed or a bank’s core systems have been breached. But it can still make a product unusable. For customers, the difference between “assets are safe” and “I can move my assets” is material. For operators, the service interruption can create operational, regulatory and reputational consequences even when the underlying balance sheet and infrastructure remain intact.
The incident is a live case of vendor concentration in digital bank operations. If a single screening service is a required control in a transaction path, its unavailability can force a business to stop that path. That is true whether the provider is Chainalysis or another specialist vendor.
How did the Chainalysis incident expose concentration risk?
Chainalysis’s disruption shows how a specialist compliance dependency can become an operational bottleneck. Nubank uses Chainalysis KYT, or Know Your Transaction, to screen crypto transactions for money-laundering risk. Chainalysis said it detected unauthorised access on some KYT accounts and took services offline during its response.
The company reported that an on-path attack exposed user IDs, names, email addresses, usernames, password hashes and live session tokens for all users. It said Reactor, KYT and Address Screening had been restored by 7 November, with mandatory credential resets and API key rotations. Other services remained under maintenance, and no full-restoration timeline had been published. The Register also reported that some law-enforcement and customer tokens were among those stolen; that detail is attributed to its reporting, rather than treated as a separately confirmed statement from Chainalysis.
The strategic point is not that every fintech should use multiple vendors for every control. It is that teams need to know when a service has become a single point of failure. If the answer to “What happens when this vendor is unavailable?” is “we stop the product”, that is a resilience decision, whether or not it was explicitly made as one.
Why does the “agentic” attack reference change the security conversation?
The reference to “offensive agentic techniques” is a reminder that agentic AI is part of the attacker-side security discussion, not only a tool banks may deploy. Chainalysis used that phrase to describe the techniques involved in the attack. The Record reported the company had not explained what the phrase meant, and did not explicitly establish that an autonomous AI agent caused the breach.
That distinction is important. The label should not be stretched into a claim about the attacker’s exact tools or methods. The practical point is simpler: security teams should consider how AI-enabled or agentic approaches could affect threats to the vendors they depend on, as well as their own environments.
For payment operators, third-party risk management must therefore connect security review with service continuity. A vendor’s breach response may include taking tools offline, restricting access or requiring customers to rotate credentials. Each step can be appropriate for security and still affect a payment product. For further context on the evolving trust questions around agents, see our analysis of five agent identity protocols and the standards gap and Visa’s first live trusted agent protocol pilot.
What should payment operators do when a screening vendor goes down?
Operators should treat compliance-service availability as part of product design, not just procurement. A resilience plan needs to answer what happens to transactions, customers and reporting if a critical vendor cannot screen activity.
Fallback design requires judgement. A secondary screening provider may reduce concentration but introduce integration complexity, inconsistent results or additional oversight requirements. A manual process may be suitable only for a narrow set of cases and a short period. The right design depends on the product, risk appetite and applicable obligations. The important thing is to test it before an incident, not invent it during one.
This is the same design discipline payments teams need as new transaction channels emerge. Our coverage of Sardine’s Know Your Human approach considers identity signals in agentic payments; this incident presents a different question: can your compliance stack keep operating when a key supplier cannot?
Frequently asked questions about the crypto-service disruption
Why did Nubank and Mercado Pago pause crypto services?
Both restricted crypto movements from 6 November after external-provider instability. Nubank paused deposits and withdrawals while internal buy and sell functions remained available. Mercado Pago restricted transfers to external wallets. The companies did not publicly confirm that the same vendor caused both incidents.
What happened to Chainalysis?
Chainalysis reported unauthorised access and an on-path attack that exposed user information, password hashes and live session tokens. It took some tools offline as it responded. Reactor, KYT and Address Screening were restored by 7 November, with mandatory credential resets and API key rotations; other services remained under maintenance.
Is customer money safe?
Nubank and Mercado Pago said customer assets were safe and that their own infrastructure was not compromised. The reported issue concerned external-provider disruption and service availability, not a confirmed compromise of customer assets.
What should payment operators learn from this?
Map critical vendor dependencies, define and test fallback procedures, document how AML screening obligations will be managed during an outage, rotate credentials when required and communicate clearly with customers. A vendor outage can become a product outage if there is no workable alternative.
Key takeaway
Third-party concentration risk is not theoretical. A provider’s service disruption can affect a product even when the payment company’s own systems and customer assets remain safe. For fintechs, PayFacs, issuers and other payment operators, operational resilience means knowing which vendor dependencies can stop a product, and having a tested response before they do.