Chainalysis Estimates $49 Million Stolen From Mercado Bitcoin
Key Facts
Mercado Bitcoin temporarily halted its platform and suspended deposits, withdrawals and asset trading after detecting a security incident in the early hours of Nov. 2, the company said. Chainalysis said the attacker moved assets across 17 blockchain networks and estimated the stolen funds at about $49 million. That figure remains an independent estimate by Chainalysis, while the platform said the value of the assets involved may change as prices move. The company said suspending services was a precautionary security measure taken after the incident was detected. It did not set a date for resuming operations, saying it would restore them when conditions were fully secure.
Mercado Bitcoin said in an FAQ update that assets equivalent to about $12.9 million had been blocked with help from members of the crypto community, asset issuers and specialist recovery partners. In its account of its response on Nov. 2, Chainalysis said it coordinated with the platform, law enforcement and industry partners to help freeze nearly $10 million of the stolen funds. The figures reflect different updates on the response: the platform gave its latest estimate of the amounts blocked, while the Chainalysis figure covered what it said it helped freeze on the day of the incident. The platform added that it was working with partners to expand recovery of funds that could still be blocked. The efforts show that tracing and recovery continued after trading and transfers were halted.
Bitquery provided an independent account of on-chain fund movements, counting $48.6 million in assets leaving Mercado Bitcoin wallets across 10 networks on Nov. 2, valued at the time of transfer. Its tracking differs in methodology and scope from Chainalysis' estimate of $49 million, which covered movements across 17 networks. Chainalysis said bitcoin and ether made up the largest shares of the assets moved, without implying that the estimates from the groups tracking the movements matched. Mercado Bitcoin said the incident affected hot wallets, while most assets are held in offline cold wallets. These details provide context for the scale of the observed movement as services remained suspended during the security response.
In its message to customers, Mercado Bitcoin said records of their balances remained intact and they would not lose their assets. Deposits, withdrawals and asset trading remain suspended while the company completes its security requirements. It also said it had notified the relevant authorities but could not release details about suspects while official investigations were underway. The platform did not confirm whether the incident was linked to the attack on Binance, saying that could not be determined at this time. It said it would publish updates on service status through its official channels, without setting a dated timeline for their return.