The hacker responsible for the $46 million Mercado Bitcoin breach has moved approximately $8 million worth of Ethereum to new wallets. Meanwhile, blockchain investigators have identified and frozen more than $9 million in stolen cryptocurrency.
Summary
- Arkham reported that the hacker transferred around $8 million in Ethereum to new wallets following the breach.
- More than $9 million in stolen cryptocurrency has been frozen, but the attacker still controls millions of dollars in assets across several blockchains.
- Lookonchain warned that altcoins such as PEPE, AAVE, PENDLE, VIRTUAL, and ONDO could face selling pressure if the hacker starts liquidating the remaining funds.
- Arkham raised the possibility that the transferred ETH could eventually be sent to Tornado Cash, but its latest update did not confirm any deposits into the protocol.
Blockchain analytics platform Arkham reported the latest transfers on November 3. The movements have raised questions about where the stolen funds could go next as investigators continue tracking them across multiple networks.
According to Arkham’s latest wallet data, the attacker still controls a cryptocurrency portfolio worth approximately $46 million. The platform questioned whether the transferred ETH could eventually reach Tornado Cash, but no such transfer had been confirmed.
The latest activity follows the November 2 attack on Brazil’s largest cryptocurrency exchange. The breach affected wallets across at least 10 blockchains and led the exchange to temporarily suspend deposits and withdrawals.
Mercado Bitcoin hacker moves ETH while holding millions in altcoins
Arkham’s transaction records show that the attacker has been moving stolen Ethereum between several wallets linked to the breach.
The latest transfers included approximately 2,900 ETH worth $6.52 million, along with smaller transactions involving 470 ETH and 200 ETH. Together, these movements account for roughly $8 million in ETH transfers highlighted by the analytics firm.
Arkham raised the possibility that the attacker could use Tornado Cash, but its update showed transfers between wallets attributed to the hacker. It did not confirm that the funds had reached the mixing protocol.
Tornado Cash is a cryptocurrency mixing protocol designed to make it harder to trace the connection between sending and receiving wallet addresses. Investigators will be watching where the transferred ETH moves next.
Meanwhile, Lookonchain reported that the attacker still holds several altcoins worth more than $1 million each. These include approximately 372.99 billion PEPE tokens valued at $1.79 million.
Other holdings include:
- 12,820 AAVE worth $1.61 million.
- 769,950 PENDLE worth $1.35 million.
- 29,830 EVA valued at $1.26 million.
- 1.98 million VIRTUAL tokens worth $1.15 million.
- 147,840 UNI worth $1.04 million.
- 2.67 million ONDO valued at $1.03 million.
Lookonchain warned that these tokens could face selling pressure if the attacker decides to sell the remaining holdings.
Arkham’s on-chain investigation also identified 287 token swaps involving the attacker’s wallets. These included sales of smaller cryptocurrencies such as RENDER, WIF, KMNO, and POPCAT.
More than $9 million in stolen cryptocurrency frozen
Efforts to restrict access to the stolen funds have resulted in more than $9 million worth of cryptocurrency being frozen through cooperation between blockchain investigators, law enforcement agencies, and cryptocurrency issuers.
In a November 2 report, blockchain analytics company Chainalysis said its investigators worked directly with Mercado Bitcoin after the exchange reported the security incident.
The company contacted law enforcement within 30 minutes of identifying wallet addresses containing assets that could potentially be frozen.
Chainalysis also coordinated with Tether, Paxos, Circle, Ripple, and Anchorage Digital to identify and restrict access to stolen funds where possible.
According to the company, Tether later froze more than $9 million in assets linked to the attack. The initial response had already secured approximately $4 million in stablecoins, with further freezes carried out over the following hours.
However, a significant amount of stolen cryptocurrency remains under the attacker’s control. Investigators are continuing to monitor wallet activity and identify additional funds that may be recovered.
How did the Mercado Bitcoin hack happen?
The breach began on November 2, when an attacker gained unauthorized access to one of Mercado Bitcoin’s systems and transferred cryptocurrency from wallets linked to the exchange.
Mercado Bitcoin temporarily suspended cryptocurrency deposits and withdrawals while its security team investigated the incident and worked with authorities.
The exchange said it had contained the breach and maintained that customers had not suffered any harm or data exposure.
Investigators later identified transfers involving Bitcoin, Ethereum, Solana, Tron, and several other cryptocurrencies.
Arkham’s investigation showed that the attacker initially moved 2,852 ETH worth approximately $6.52 million from an exchange hot wallet. This was followed by transfers of $2.99 million in USDT and $2.24 million in USDC.
Another transaction involved approximately 104.43 BTC valued at $8.16 million, while smaller transfers included tokens held across other networks.
A separate investigation by Bitquery estimated that approximately $48.5 million had been transferred from exchange wallets across 10 blockchains. This was higher than Arkham’s initial estimate of at least $46 million.
Bitquery also identified additional transactions involving Ethereum deposit addresses after the exchange had publicly announced that the incident was contained.
Mercado Bitcoin later published the destination addresses identified during the attack across Ethereum-compatible networks, Bitcoin, Solana, Stellar, and Tron. The aim was to help investigators track the stolen funds.
Another major crypto exchange breach within two weeks
The Mercado Bitcoin incident came just four days after Binance suffered a separate security breach on October 29, resulting in approximately $6.3 billion in stolen cryptocurrency.
The Binance incident triggered a major recovery effort involving blockchain investigators, token issuers, and the exchange’s own financial resources.
Binance later began replacing the affected assets using its corporate treasury, Secure Asset Fund for Users (SAFU), and part of its futures insurance fund.
By November 1, the exchange said it had replaced 95% of the affected assets and had started restoring Bitcoin withdrawals.