The Mercado Bitcoin hack has taken another turn after blockchain investigators identified approximately $8 million in Ethereum moving into new cryptocurrency wallets.
The transactions follow the November 2 security breach at Brazil’s major cryptocurrency exchange, where attackers reportedly transferred between $46 million and $49 million in digital assets.
While investigators have already helped freeze nearly $10 million in stolen cryptocurrency, a significant portion remains outside their control.
We believe the latest Ethereum transfers highlight one of the biggest challenges facing the industry: recovering stolen funds before attackers move them through increasingly complicated blockchain transactions.
TL;DR
Wallets linked to the Mercado Bitcoin hack transferred approximately $8 million in Ethereum following the exchange’s security breach. Blockchain investigators helped freeze nearly $10 million in stolen assets, including more than $9 million in USDT. Researchers are monitoring whether the stolen Ethereum could move through Tornado Cash, although no such transfer has been confirmed.Mercado Bitcoin Hack Investigation Tracks New Ethereum Transfers
Blockchain analytics company Arkham Intelligence reported on November 3 that wallets associated with the Mercado Bitcoin attacker had transferred approximately $8 million in ETH to new addresses.
The transactions included movements of roughly 2,900 ETH, alongside smaller transfers involving 470 ETH and 200 ETH.
These transfers have attracted attention because investigators are attempting to establish where the stolen assets may move next.
Arkham also raised the possibility that the attacker could eventually use Tornado Cash, a cryptocurrency privacy protocol that makes transaction tracing more complicated.
However, we want to emphasize an important distinction.
The available information does not confirm that the attacker has deposited the Ethereum into Tornado Cash.
For now, the identified transfers involve addresses associated with the attacker, and their ultimate destination remains uncertain.
Nearly $10 Million in Stolen Cryptocurrency Frozen
The investigation has already produced significant results.
According to a November 2 Chainalysis investigation , security researchers worked with Mercado Bitcoin, law enforcement agencies, and cryptocurrency issuers to identify and restrict stolen assets.
Chainalysis reported that its investigators contacted authorities within approximately 30 minutes of receiving information about the attack.
The company coordinated with several industry participants, including Tether, Circle, Paxos, Ripple, and Anchorage Digital.
These efforts helped freeze nearly $10 million in stolen cryptocurrency.
Tether alone restricted access to more than $9 million in assets linked to the incident.
We see this response as evidence that rapid cooperation between exchanges, blockchain investigators, and token issuers can limit the financial damage following a major breach.
However, frozen assets are not necessarily recovered funds. Additional legal and operational steps may be required before they can be returned.
Hacker Still Controls Millions in Altcoins
Ethereum is not the only cryptocurrency involved in the investigation.
Blockchain monitoring accounts have identified substantial holdings in several alternative cryptocurrencies, including PEPE, AAVE, PENDLE, VIRTUAL, UNI, and ONDO.
Some of these positions were individually valued at more than $1 million.
Researchers have warned that the attacker could create additional selling pressure if these holdings are liquidated.
Arkham has also identified hundreds of token swaps involving wallets linked to the incident.
The activity includes transactions involving smaller cryptocurrencies, suggesting that the attacker has already begun reorganizing portions of the stolen portfolio.
We believe these movements deserve attention because selling stolen tokens can affect market liquidity, particularly when trading volumes are limited.
Exchange Security Faces Renewed Scrutiny
The Mercado Bitcoin incident follows another major security breach involving Binance.
As we previously reported, the Binance hack exposed serious concerns about cryptocurrency wallet security .
The two incidents have different circumstances, and investigators have not established a connection between them.
Nevertheless, both highlight the challenges associated with protecting digital assets held by centralized cryptocurrency exchanges.
Our earlier Mercado Bitcoin coverage detailed the exchange’s decision to suspend deposits and withdrawals following the initial suspicious transactions.
Mercado Bitcoin has maintained that customers were not harmed and that no customer data breach occurred.
We believe the industry’s response will be judged not only by the amount of cryptocurrency frozen but also by how effectively exchanges protect customers and restore normal operations.
What Happens Next?
Investigators continue monitoring the stolen Ethereum and other cryptocurrency holdings.
The immediate questions concern whether additional assets can be frozen, whether the attacker attempts to use mixing services, and how much of the stolen cryptocurrency can ultimately be recovered.
We previously examined how Tornado Cash can complicate investigations into stolen funds .
For now, we will be watching new wallet movements, announcements from blockchain security companies, and updates from Mercado Bitcoin.
The investigation remains active, and the next major transfers could determine whether authorities have further opportunities to restrict the stolen funds.