Chainalysis estimates Mercado Bitcoin theft at about $49 million across 17 networks
Key Facts
Chainalysis estimated that an attacker stole about $49 million in crypto assets from Mercado Bitcoin, after beginning to move them in the early hours of November 2 across 17 blockchains. In its official statement, the platform said it had temporarily taken the service offline as a precaution after discovering the incident, stressing that the impact was limited to hot wallets used for daily operations. Chainalysis described Mercado Bitcoin as Brazil’s largest cryptocurrency platform. In an update published at 21:00 that day, the platform said about $38 million in assets had not yet been frozen. It also assured customers they would not lose assets, while its teams began tracing the funds and coordinating with relevant parties.
Mercado Bitcoin said its cold wallets were unaffected and that the breach hit only its hot wallets. The platform temporarily suspended access to its services as a precaution, without specifying in its update an immediate date for resuming operations. CoinDesk reported that the platform said customer data had not been leaked, and that its teams were investigating the incident, tracing the assets and coordinating with authorities. In a report published on November 3, CoinDesk said the platform would cover the losses and estimated the amount it would absorb at about $38 million. The report said Mercado Bitcoin expected customers to suffer no losses as a result of the breach.
In its update at 21:00 on November 2, Mercado Bitcoin said it had frozen about $11 million with help from parties including Tether, Circle, BRL1, Paxos and Chainalysis. It added that it was working to expand asset recovery, while about $38 million remained unfrozen, according to the same update. Chainalysis said its assistance had led to $4 million in stablecoins being frozen by the morning of November 2, and that the total it had helped freeze rose to $9 million over the following hours. These are figures from two parties measured at different times: the platform reported the total it said had been frozen, while Chainalysis disclosed the results of its own intervention. The company said it was continuing to trace the remaining funds, monitor their movements and look for further opportunities to intervene.
Chainalysis said the largest outflows were in Bitcoin and Ethereum, while other assets moved across Base, Tron and Polygon, within a total of 17 blockchains. Bitquery, in a separate analysis, estimated outflows from Mercado Bitcoin wallets at about $48.5 million across 10 chains, calculated using the value of assets at the time of each transfer. The Chainalysis and Bitquery estimates are close in the amount of funds moved, but reflect different methods for tracking transfers and identifying the networks on which they appeared. In Chainalysis’s account of the timeline, a Mercado Bitcoin executive contacted a company expert at 2:30 a.m. Eastern Time on November 2, after the attacker began moving funds in the early hours. The company said it contacted law enforcement within 30 minutes of that call.
Mercado Bitcoin said the platform would not resume operations until it had verified that it was safe for users, and that it would announce a restart date through its official channels in later updates. The company did not specify a date for restoring service in its statement, while Chainalysis said its work to trace and freeze funds was continuing after the initial measures. CNN Brasil placed the incident as the second publicly reported security incident in the crypto-asset market in less than a week, after an incident reported by Binance on October 29. The network also said major crypto assets fell on Monday as concerns grew about investor confidence, institutional security, liquidity and exposure to centralized counterparties. The recovery of assets and the platform’s resumption remained contingent on the company’s subsequent updates and confirmation that operations were safe.