Mercado Bitcoin Hacker Moves $8M in ETH as $9M Is Frozen
The attacker behind the $46 million Mercado Bitcoin breach has moved roughly $8 million in Ethereum to new wallets, according to Arkham. Blockchain investigators and token issuers have frozen more than $9 million in stolen assets, while the exchange's deposits and withdrawals remain suspended.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Latest Fund Movements
Arkham reported on November 3 that the attacker behind the Mercado Bitcoin breach moved approximately $8 million worth of Ethereum to new wallets. The largest single transfer was about 2,900 ETH, valued at $6.52 million, with smaller transfers of 470 ETH and 200 ETH. The attacker still controls a portfolio valued at roughly $46 million, according to Arkham's wallet data.
The transfers are the latest activity following the November 2 attack on Brazil's largest cryptocurrency exchange, which affected wallets across at least ten blockchains. Other reported movements include transfers of 2.24 million USDC and 1.7 million TRX. Deposits and withdrawals on the exchange remain suspended.
Where the Funds Could Go
Arkham questioned whether the transferred ETH could eventually be deposited into Tornado Cash, a mixing protocol that can make it harder to trace links between sending and receiving addresses. The firm did not confirm any such deposit, and the transfers it documented went to wallets attributed to the attacker.
Altcoin Holdings
Lookonchain reported that the attacker still holds several altcoin positions, including about 372.99 billion PEPE ($1.79 million), 12,820 AAVE ($1.61 million), 769,950 PENDLE ($1.35 million) and 29,830 EVA ($1.26 million). The wallet also contains roughly 1.98 million VIRTUAL ($1.15 million), 147,840 UNI ($1.04 million) and 2.67 million ONDO ($1.03 million). Lookonchain warned that these holdings could face selling pressure if liquidated. Arkham identified 287 token swaps involving the attacker's wallets, including sales of smaller tokens such as RENDER, WIF, KMNO and POPCAT.
Freezes and Law Enforcement Response
Chainalysis said in a November 2 report that it worked directly with Mercado Bitcoin after the exchange disclosed the incident, and contacted law enforcement within 30 minutes of identifying addresses holding potentially freezable assets. The firm said it coordinated with Tether, Paxos, Circle, Ripple and Anchorage Digital. Tether subsequently froze more than $9 million linked to the attack. Chainalysis said the initial response had already secured approximately $4 million before the broader freezes.
Discrepancies in Reported Figures
The sources differ on the size of the frozen amount. Crypto.news cited more than $9 million in frozen assets from its reporting, while the combined freeze figure with the initial response is described by Chainalysis as an effort that secured nearly $10 million. The sources also differ in how they frame the stolen total: the $46 million figure refers to the value the attacker still controls, not the full amount taken in the breach, and the reports do not state a single consolidated loss figure.
Why It Matters
For Traders
Liquidation of the attacker's altcoin holdings, including PEPE, AAVE and PENDLE, could add short-term selling pressure on those tokens if the wallets begin moving them.
For Investors
The breach and its aftermath highlight custody and exchange security risk in Latin American markets, and the speed of issuer-level freezes shows how stablecoin issuers can restrict stolen funds.
For Builders
Exchanges and protocols operating across many chains should review hot-wallet controls and cross-chain monitoring, since the attack spanned at least ten blockchains.
This article is for information only and is not financial advice. Read the full disclaimer.
