An attacker who drained at least $46 million from Brazil’s largest cryptocurrency exchange has begun moving stolen ether to fresh wallets, blockchain analytics firm Arkham reported on November 3. The transfers total roughly $8 million in ETH and come one day after Mercado Bitcoin confirmed the breach and suspended deposits and withdrawals.
Attacker Drained Up to $48.5 Million Across Ten Blockchains
The attack struck on November 2, targeting one of Mercado Bitcoin’s hot wallet systems. Arkham initially estimated the haul at $46 million across multiple blockchains. A separate investigation by on-chain analytics provider Bitquery placed the total closer to $48.5 million, spread across ten networks including Ethereum, Bitcoin, Solana, Stellar, and Tron.
The initial transfers included approximately 2,852 ETH worth $6.52 million from a hot wallet, $2.99 million in USDT, $2.24 million in USDC, and 104.43 BTC valued at about $8.16 million.
According to crypto.news, incident response firm Chainalysis contacted law enforcement within 30 minutes of identifying potentially freezable assets and coordinated with Tether, Paxos, Circle, Ripple, and Anchorage Digital. More than $9 million has been frozen in total across 65 addresses, including $4.5 million in USDT frozen by Tether, according to Arkham.
Stolen ETH Moves to Fresh Addresses Within 24 Hours
Arkham posted on November 3 that “the Mercado Bitcoin hacker just moved $8M of ETH to new wallets.” The transfers included the movement of approximately 2,852 ETH, initially valued at $6.52 million, alongside smaller sends of 470 ETH and 200 ETH to addresses linked to the attacker.
The firm estimates that approximately $46 million was stolen in total, not that the attacker still controls that amount. On-chain tracker Lookonchain detailed the altcoin holdings, listing positions exceeding $1 million each in PEPE, AAVE, PENDLE, VIRTUAL, UNI, and ONDO.
Cointelegraph reported that approximately $20 million had moved to newly created wallets, while more than $20 million, including roughly 106 BTC, remained in addresses identified by Mercado Bitcoin.
Arkham also tracked 287 token swaps, including sales of smaller holdings such as RENDER, WIF, and POPCAT. Lookonchain warned that the remaining altcoins “could face selling pressure.”
Second Major Exchange Hack in a Week Tests Rapid-Freeze Protocols
The breach arrived four days after the $6.3 billion Binance hack on October 29, making it the second major exchange security incident in under a week.
The sequence is likely to intensify regulatory scrutiny in Brazil, where existing crypto firms had to file their authorization requests with the Central Bank by October 30 under rules that took effect on February 2, 2026. The crypto licensing framework establishes minimum capital and custody requirements.
More than $9 million was frozen within a day across 65 addresses, highlighting the role of coordination between stablecoin issuers, custodians, and incident response firms in limiting the movement of stolen assets
On-Chain Trackers Publish Attacker Wallet Breakdown
The incident drew immediate attention from on-chain trackers. Lookonchain posted that “another exchange, @MercadoBitcoin, has been hacked for over $46M” and published a breakdown of the attacker’s remaining token positions. Mercado Bitcoin and analytics firms also published wallet addresses across the affected networks, allowing investigators and market participants to monitor the stolen assets.
Tornado Cash Deposit Remains The Open Risk
The open question is whether any of the stolen funds that have not been frozen move toward a mixing protocol such as Tornado Cash. Arkham flagged the possibility but has not confirmed any deposits into the mixer. Mercado Bitcoin has published destination addresses across its affected networks, and the reported law enforcement coordination through Chainalysis remains part of the response.
