Hypernative Detects Suspicious Transfers Exceeding $40 Million in Mercado Bitcoin Case
Key Facts
Hypernative’s preliminary estimate identified suspicious transfers worth more than $40 million across multiple blockchains, according to a report published by Bitnoticias on November 2, 2026. The estimate comes amid movements linked to addresses suspected of being connected to a potential attacker of the Mercado Bitcoin platform. But the figure is not a confirmed tally of funds stolen from the platform; the report describes the transfers as suspicious and does not establish the source of the funds. The report quoted Hypernative as saying, "The preliminary estimate points to suspicious transfers exceeding $40 million." That wording remains important when reading the figures in circulation, as it distinguishes the value of the observed movements from losses confirmed as belonging to the platform.
Among the balances cited by the report were about 6.7 million units of XLM at an address on the Stellar network that it linked to the alerts and suspicious movements. The report quoted Hypernative as saying that this balance appeared at the address it flagged, but stressed that its presence there was not enough to prove it had been stolen from Mercado Bitcoin. The report said, "6.7 million units of XLM on the Stellar network, but the presence of the funds at this address alone does not prove they were stolen from Mercado Bitcoin." The figure therefore should not be presented as a confirmed amount stolen or as belonging to the platform’s assets. Establishing the source of the balance is a separate question from detecting its presence at an address connected to the movements under investigation.
The report also cited other approximate balances linked to the addresses covered by the alert, including 2,852 units of ETH at an address on the Ethereum network. It also listed 106 units of BTC at an address on the Bitcoin network. Like the XLM balance, these figures are balances at addresses the report cited when describing the suspicious movements; on their own, they do not show that the platform owned the funds or that they left its accounts. Accordingly, they cannot be added up and described as confirmed Mercado Bitcoin losses based solely on the information in the report. The broader figure, exceeding $40 million, remains a preliminary estimate of the value of transfers the source described as suspicious.
The monitoring also covers more than 200 other tokens that the report said researchers found linked to the addresses they were tracking. This number reflects the breadth of the list of assets associated with the addresses flagged, without proving on its own that all those tokens moved from the platform or form part of its losses. A link between a token and an address describes what the researchers observed; establishing ownership and the source of the funds requires information the report did not provide in these details. This places the specified XLM, ETH and BTC balances within a broader group of tokens linked to the addresses, rather than a definitive list of losses. The movements remain under monitoring, according to the report citing Hypernative.
As a next step, Hypernative recommended that over-the-counter trading platforms and blockchain bridges, as well as exchanges, monitor the addresses linked to these movements. The recommendation is aimed at tracking the addresses cited in the alert across entities that may interact with them, according to the Bitnoticias report. The report did not specify a deadline for this monitoring or any subsequent outcome. Nor does the available account include independent confirmation from Mercado Bitcoin of the balance details or their source. Based on the report, the available conclusion is that Hypernative detected suspicious transfers exceeding $40 million, and that the funds’ ownership by the platform was not established merely by their appearance at the cited addresses.