Preliminary Estimate Puts Transfers From Mercado Bitcoin Wallets Above $40 Million
Key Facts
Mercado Bitcoin suspended deposits and withdrawals as a precaution after a security incident in one of its systems, while CoinDesk estimated preliminary outflows at more than $40 million. The platform said the incident was contained quickly and that its teams were investigating, tracking the assets and coordinating with authorities. It added that customers would not be affected and that their data had not been breached. The suspension of deposits and withdrawals means customers cannot carry out either transaction through the platform during the investigation. But the company’s statement did not say that all platform functions had stopped. The sources did not specify how the attacker obtained signing authority.
CoinDesk provided a preliminary estimate of more than $40 million, while Bitquery’s analysis tracked transfers across 10 networks. These figures show the breadth of the transfers being tracked, while CoinDesk’s preliminary estimate remains distinct in nature from the monitoring of on-chain transfers. CoinDesk did not attribute the attack to any specific actor. Nor was there public evidence linking the incident to the Binance hack cited in the report. The attacker’s identity and how they obtained signing authority therefore remained undisclosed.
CoinDesk reported that the assets held by the attacker included about 2,852 Ether, 106 Bitcoin and 10,700 Solana. They also included 6.7 million Stellar and 77,000 Avalanche, as well as more than 200 other tokens. The list shows a mix of assets on different networks, while the platform said it was tracking the assets in coordination with authorities. The report does not give a separate total value for each asset on the list. Tether founder, according to CoinDesk, confirmed the freezing of $4.5 million in USDT linked to the hack. That remains the amount the founder confirmed in the report, with no other party added to the freezing operation.
Bitquery tracked another part of the transfers on the Ethereum network, saying 35,853 deposit addresses belonging to the platform’s customers had emptied their balances toward the attacker by 15:44 UTC on November 2. The value transferred from those addresses was $261,000. Later in the afternoon, the attacker moved $19.5 million to 10 new Ethereum wallets, according to Bitquery, which had not detected a deposit of those funds at a crypto exchange by the time of its check at 15:46 UTC. This means tracking detected the funds moving to new wallets, while the report did not record them reaching an exchange during the monitoring period. The report also said most of the funds remained in the attacker’s wallets, without specifying a total remaining balance.
The incident comes as cryptocurrency platforms have faced calls to strengthen defenses and share information following the Binance hack. Reuters quoted the head of OKX calling for a real-time alert system that would allow companies to share information when a hack occurs, coordinate a rapid response and temporarily freeze funds suspected of being stolen. Separately, the Associated Press said the entity known as TraderTraitor was the same one blamed for the $1.5 billion Bybit hack the previous year. But CoinDesk said there was no public evidence linking the Mercado Bitcoin incident to the Binance attack. A cryptocurrency expert told the Associated Press that splitting up and laundering stolen assets through smaller platforms could take months, while transfers could be tracked to disrupt the process or recover the funds.