Mercado Bitcoin Hack: Bitquery Says Theft Continued After Containment

Mercado Bitcoin Hacker Portfolio Reaches $48.6 Million in Traced Assets Following November 2 Breach

Hackers drained tens of millions of dollars from Brazilian cryptocurrency exchange Mercado Bitcoin on November 2, with blockchain data showing the theft continued for hours after the company declared the incident contained. While Mercado Bitcoin stated at 12:56 UTC on Nov. 2 that it had contained the breach, blockchain data platform Bitquery revealed that hackers continued draining 36,042 customer deposit addresses on Ethereum until 16:46 UTC, according to a report published Thursday. Bitquery traced $48.6 million in stolen assets across 10 blockchains, exceeding initial estimates of $40 million. Crypto Times reported separately via analytics firm Arkham Intelligence that the suspect portfolio reached approximately $46.5 million across 61 addresses, spanning Ethereum, Base, Optimism, Arbitrum, Solana, and Avalanche.

Mercado Bitcoin suspended deposits and withdrawals following the security breach, but has not yet disclosed a detailed account of how attackers gained access to internal systems or published the total value of assets directly involved, Crypto Times noted. Security researcher Specter shared data showing that approximately $9.17 million in crypto assets had been frozen across several tokens through coordinated intervention by stablecoin issuers and security teams. Bitcoinist reported that Chainalysis contacted authorities within 30 minutes of the attack, coordinating with Tether, Circle, Paxos, Ripple, and Anchorage Digital to restrict unauthorized transfers.

Blockchain Intelligence Traces Continued Ethereum Transfers and Frozen Tokens

Investigators continue tracking millions in digital assets as attackers move funds through complex blockchain transactions. Arkham Intelligence reported November 3 that wallets linked to the Mercado Bitcoin attacker transferred approximately $8 million in Ethereum to new addresses, including movements of roughly 2,900 ETH alongside smaller batches. Bitcoinist noted that these transfers raise the possibility of funds moving through privacy protocols like Tornado Cash, although no such deposit has been confirmed. The attacker retains control over substantial altcoin holdings, including PEPE, AAVE, PENDLE, VIRTUAL, UNI, and ONDO, some individually valued above $1 million.

Tether restricted access to more than $9 million in assets linked to the incident, while Circle and other issuers contributed to freezing nearly $10 million total, according to Bitcoinist. Crypto Times broke down the frozen assets further, noting $3.76 million in USDT and $2.96 million in USDC among the restricted tokens. Despite these freezes, a significant portion of the stolen portfolio remains outside investigator control, creating ongoing selling pressure risks as wallets execute token swaps.

Regulatory Scrutiny Intensifies Amid Historic Crypto Crime Wave

The breach at Mercado Bitcoin unfolds against a broader backdrop of escalating digital asset security challenges across global markets. PYMNTS noted that the attack coincides with a $6 billion hack into the Binance exchange, now recorded as the largest financial theft in history. Circle submitted comments to the Securities and Exchange Commission on October 20 urging authorities to preserve technology neutrality under the proposed Regulation Crypto Assets framework, highlighting the difficulty of overseeing financial activity operating without centralized gatekeepers.

Data from the PYMNTS Intelligence study Payment Protection: Why Firms Still Aren’t Real-Time Ready indicates that 57 percent of companies in payment-heavy industries face heightened fraud pressures. Mercado Bitcoin has pledged to cover all user losses resulting from the November 2 breach, though the exchange has not announced a timeline for resuming normal deposit and withdrawal operations.

More on this story: Binance Suffers Security Breach Involving Digital Assets · Polymarket suspended international trading after third-party breach