The attacker behind the Mercado Bitcoin security breach has sold approximately $10.55 million worth of stolen altcoins for Ethereum, according to blockchain analytics firm Arkham. The November 4 update indicates that funds continue moving through newly created wallets, while a separate attempt to bridge funds into Bitcoin appears to have been halted. The activity follows the exchange’s November 2 incident, initially estimated at around $46 million.
Table of Contents
Hacker Converts Stolen Altcoins Into 4,605 ETH
Arkham reported that wallets linked to the attacker transferred $13.26 million in tokens and ETH to 23 outside addresses over the previous day, 22 of them newly created. The assets were subsequently sold, with the largest identified token disposals including $1.82 million in PEPE, $1.65 million in AAVE and $1.14 million in VIRTUAL. The figures reflect Arkham’s on-chain tracking and should not be treated as a final accounting of the breach.
In a separate update, Arkham said 21 of the wallets and 12 labelled wallets swapped the tokens into native ETH through MetaMask Router. The swaps totalled 338 transactions, resulting in 4,605 ETH worth approximately $10.55 million. The wallets also received about $818,000 in mUSD and $104,000 in USDC, according to the tracking post.
Also Read: Tether Freezes $4.5M USDT as Mercado Bitcoin Probes $40M Breach
Bridge Transfer to Bitcoin Appears to Have Been Halted
Arkham’s earlier update said one attempted $650,000 transfer from the stolen funds toward Bitcoin through Bridgers appeared to have been halted. The development suggests that some cross-chain movement may be facing intervention, although the post did not identify who stopped the transfer or confirm whether the funds were recovered. The remaining assets continue to require monitoring across multiple addresses and networks.
The exchange breach affected assets across at least 10 blockchains, according to Arkham’s investigation. The attacker’s movement of tokens into fresh addresses and conversion into ETH complicates tracking, while swaps can create additional selling pressure in individual assets. However, the reported $10.55 million conversion does not establish a broad market impact beyond the tokens involved.
Mercado Bitcoin Says Customer Assets Are Protected
Mercado Bitcoin said the incident affected its hot wallets and that customers would not lose assets. In its November 2 customer update, the exchange said it had temporarily taken the platform offline, notified authorities and coordinated with asset issuers and security partners. It reported that approximately $11 million had been blocked, with around $38 million still not blocked at that point.
The exchange had earlier said deposits and withdrawals were temporarily suspended while its teams investigated and tracked the funds. The latest Arkham update does not confirm that services have resumed or that the full stolen amount has been recovered. The exchange’s official updates remain the key source for customer-impact and operational status.
Brazil’s Crypto Rules Put Custody Controls in Focus
The incident comes as Brazil’s central bank is implementing a formal framework for virtual-asset service providers. Resolution BCB 520, effective from February 2026, establishes requirements covering custody, governance, cybersecurity, risk management and protection of customers’ assets. The rules also require providers to maintain policies for safeguarding private keys and responding to security incidents.
The breach highlights the practical importance of controls around online wallets, which exchanges use to process routine deposits and withdrawals. Mercado Bitcoin has said the incident was limited to hot wallets, while most customer assets are held offline. The next developments to watch are further asset freezes, any confirmed recovery, the exchange’s operational reopening and whether investigators identify how the attacker obtained signing access.
Also Read: Mercado Bitcoin Investigates Cyberattack After $40M Alert
Amrin Sanjay is an Industry Reporter at Tron Weekly, covering developments across the cryptocurrency and blockchain sector. Her reporting focuses on Bitcoin, Ethereum, altcoins, and decentralized finance, alongside market activity, protocol updates, and ecosystem trends. She closely tracks Layer 1 and Layer 2 projects, DeFi tokens, and key technical indicators to explain market movements and on-chain activity with clarity and accuracy for both new and experienced readers.
