Mercado Bitcoin hack: Chainalysis says nearly $10M was frozen

Chainalysis said it helped freeze nearly $10 million in stolen funds after Mercado Bitcoin, Brazil’s largest crypto exchange, suffered a security incident that it said led to about $49 million in stolen assets. The company said it worked with the exchange, law enforcement and industry partners in the early hours of the Nov. 2 attack to trace the movement of funds and identify assets that could be interrupted.

Evidence and context

In a Nov. 2 post, Chainalysis said the attack began in the early hours of the day and involved assets held across 17 blockchains, with the largest tranches coming from Bitcoin and Ethereum. The company said its investigators logged into a digital war room from three continents and focused on identifying, tracing and labeling the stolen assets, finding opportunities for intervention, and coordinating with external partners.

Chainalysis said Mercado Bitcoin alerted its team in the early hours of the incident. At 2:30 am Eastern Time, a Mercado Bitcoin director called a Chainalysis in-country solutions expert with news of the hack, the company said. Chainalysis said it contacted law enforcement within 30 minutes and began sharing freezable addresses and other intelligence with stablecoin issuers and other partners.

By morning, Chainalysis said it had helped lock down $4 million in stolen stablecoins. It said subsequent work led to additional freezes and that, through coordination with law enforcement and companies including Paxos, Anchorage Digital, Ripple, Circle and Tether, it helped freeze more than $9 million in stolen funds at Tether. The post said the figure reflected frozen stablecoins, not the underlying Bitcoin or Ethereum taken in the attack.

Chainalysis said it was continuing to trace the remaining funds and monitor their movement. The company also noted that labeling addresses tied to the theft can help keep the activity visible and support further intervention as stolen assets move across the blockchain.

The announcement did not provide an independently verified final loss total or say the frozen funds had been returned to customers. Separate reports on Nov. 2 cited differing estimates of the theft, ranging from about $46 million to $49 million, but those figures varied by source and methodology.