The hacker behind the $46 million Mercado Bitcoin breach has transferred approximately $8 million worth of Ethereum to new wallets, while blockchain investigators have identified more than $9 million in stolen assets that have been frozen.
Summary
- Arkham reported that the Mercado Bitcoin hacker moved approximately $8 million in Ethereum to new wallets following the $46 million exchange breach.
- More than $9 million in stolen cryptocurrency has been frozen, while the attacker continues to control millions of dollars in assets across multiple blockchains.
- Lookonchain warned that several altcoins, including PEPE, AAVE, PENDLE, VIRTUAL and ONDO, could face selling pressure if the hacker begins liquidating the remaining holdings.
- Arkham raised questions about whether the transferred Ethereum could eventually reach Tornado Cash, although its latest update did not identify any confirmed deposits into the protocol.
Blockchain analytics platform Arkham reported the latest transfers on November 3, raising questions about where the stolen cryptocurrency could move next as investigators continue tracking the funds across multiple networks.
The attacker still controls a cryptocurrency portfolio valued at roughly $46 million, according to Arkham’s latest wallet data. The platform questioned whether the transferred ETH could eventually be sent to Tornado Cash, although no such deposit was confirmed in its update.
The new transactions follow the November 2 attack on Brazil’s largest cryptocurrency exchange, which affected wallets across at least ten blockchains and prompted the temporary suspension of deposits and withdrawals.
Mercado Bitcoin hacker moves ETH while retaining millions in altcoins
According to Arkham’s transaction records, the attacker has been distributing stolen Ethereum between several addresses associated with the breach.
The latest activity includes a transfer of approximately 2,900 ETH, valued at $6.52 million, alongside smaller transactions involving 470 ETH and 200 ETH. The movements form part of the roughly $8 million in ETH transfers highlighted by the analytics firm.
Although Arkham raised the possibility of Tornado Cash being used, the transfers shown in its update involved wallets attributed to the attacker.
Tornado Cash is a cryptocurrency mixing protocol that can make it more difficult to trace the relationship between sending and receiving addresses. The destination of the transferred ETH remains an important part of the investigation.
Meanwhile, blockchain tracking platform Lookonchain reported that the attacker continues to hold several altcoins worth more than $1 million each, including approximately 372.99 billion PEPE tokens valued at $1.79 million.
Other holdings include 12,820 AAVE worth $1.61 million, 769,950 PENDLE worth $1.35 million, and 29,830 EVA valued at $1.26 million.
The wallet contains roughly 1.98 million VIRTUAL tokens worth $1.15 million, 147,840 UNI worth $1.04 million, and 2.67 million ONDO valued at $1.03 million.
Lookonchain warned that the remaining altcoins could face selling pressure if the attacker decides to liquidate the holdings.
Arkham’s on-chain investigation identified 287 token swaps involving the attacker’s wallets, including sales of smaller cryptocurrencies such as RENDER, WIF, KMNO and POPCAT.
Over $9 million in stolen cryptocurrency frozen
Efforts to restrict access to the stolen assets have resulted in nearly $10 million being frozen through coordination between blockchain investigators, law enforcement and cryptocurrency issuers.
In a November 2 report, blockchain analytics company Chainalysis said its investigators worked directly with Mercado Bitcoin after the exchange reported the security incident.
The company contacted law enforcement within 30 minutes of identifying addresses containing assets that could potentially be frozen.
Chainalysis said its investigation involved coordination with Tether, Paxos, Circle, Ripple and Anchorage Digital to identify and restrict stolen assets where possible.
According to the company, Tether subsequently froze more than $9 million in assets linked to the attack, following the identification of wallets containing stolen funds.
The initial response had already secured approximately $4 million in stablecoins before further freezes were carried out over the following hours.
Despite those actions, a substantial portion of the stolen cryptocurrency remains under the attacker’s control, with investigators continuing to monitor transfers and identify additional assets that may be recoverable.
How did the Mercado Bitcoin hack unfold?
The breach began on November 2 when an attacker gained unauthorized access to one of Mercado Bitcoin’s systems and transferred cryptocurrency from wallets associated with the exchange.
As crypto.news previously reported, Mercado Bitcoin temporarily halted cryptocurrency deposits and withdrawals while its security teams investigated the incident and coordinated with authorities.
The exchange said it had contained the security incident and maintained that customers had suffered no harm or data breach.
Blockchain investigators subsequently identified transfers involving Bitcoin, Ethereum, Solana, Tron and numerous other cryptocurrencies.
Arkham’s investigation showed that the attacker initially transferred 2,852 ETH worth approximately $6.52 million from an exchange hot wallet, followed shortly by $2.99 million in USDT and $2.24 million in USDC.
Another transaction involved approximately 104.43 BTC valued at $8.16 million, while smaller transfers involved dozens of tokens held across other networks.
Meanwhile, a Bitquery investigation estimated that approximately $48.5 million had been transferred from exchange wallets across ten blockchains, compared with Arkham’s initial estimate of at least $46 million.
Bitquery identified further transactions involving Ethereum deposit addresses after the exchange had publicly announced that the incident was contained.
Mercado Bitcoin later published the destination addresses identified during the incident across Ethereum-compatible networks, Bitcoin, Solana, Stellar and Tron to help blockchain investigators monitor the stolen assets.
Second major crypto exchange breach in two weeks
The Mercado Bitcoin incident occurred just four days after Binance suffered a separate security breach on October 29 that resulted in approximately $6.3 billion in stolen cryptocurrency.
The Binance security breach prompted a large recovery operation involving blockchain investigators, token issuers and the exchange’s own reserves.
Binance subsequently began replenishing affected assets using its corporate treasury, SAFU reserves and part of its futures insurance fund.
By November 1, the exchange said it had replenished 95% of the affected assets and resumed Bitcoin withdrawals.