Disrupting the Mercado Bitcoin Attack: How Chainalysis Led the Freeze of Nearly $10M in Stolen Funds
The Chainalysis report details its role in responding to the Mercado Bitcoin hack that stole roughly $49 million, highlighting how it helped freeze close to $10 million of the illicit proceeds. The key outcome was the rapid coordination that locked down $4 million in stablecoins early and later secured over $9 million via Tether.
Key points
- Chainalysis mobilised a global team within minutes of the breach.
- Investigators identified and froze $4 million in stablecoins on the first morning.
- Collaboration with Tether led to more than $9 million in frozen USDT.
- Nearly $10 million of the $49 million stolen was immobilised early on.
- The response relied on rapid intel sharing with law‑enforcement and issuers.
- Total stolen funds
- $49 million
- Funds frozen overall
- nearly $10 million
- Initial stablecoin lock
- $4 million
- Tether‑related freeze
- over $9 million
- Initial lock4 $ million
- Tether freeze9 $ million
- Total frozen10 $ million
Incident Overview
Mercado Bitcoin, Brazil’s leading crypto exchange, reported a security breach on November 2 that resulted in an estimated $49 million being siphoned across 17 blockchains. The attack spanned major assets such as Bitcoin and Ethereum as well as smaller chains like Base, Tron and Polygon. Chainalysis, a longtime client of the exchange, was alerted early and immediately activated its global investigative team.
Methodology and Immediate Priorities
Chainalysis analysts from three continents entered a digital war‑room to map the flow of stolen funds. Their three‑fold agenda was to (1) label and trace the illicit assets, (2) pinpoint opportunities where the assets could be frozen, and (3) coordinate with external partners—including law‑enforcement, stablecoin issuers and custodians—to act on that intelligence. Within 30 minutes of the initial call, the team shared freezable addresses with authorities and began outreach to stablecoin providers.
Key Findings and Actions
By the time morning arrived, Chainalysis had helped lock down $4 million in stolen stablecoins. Continued monitoring and collaboration with firms such as Paxos, Anchorage Digital, Ripple, Circle and Tether expanded the freezes. Notably, the firm’s investigators traced USDT holdings to addresses that could be acted upon, prompting Tether to freeze over $9 million. In total, the coordinated effort resulted in the immobilisation of nearly $10 million of the stolen proceeds, representing roughly one‑fifth of the total loss.
Caveats and Ongoing Work
The report stresses that the response is not a one‑time event. Funds continue to move, and Chainalysis is still tracking the remaining assets, labeling addresses and sharing intelligence with partners capable of intervening. The figures cited are based on the information available at the time of writing and may evolve as further tracing occurs.
Implications for the Crypto Ecosystem
The case underscores the importance of rapid, cross‑industry collaboration when a breach occurs. Early identification of freezable stablecoins can significantly limit an attacker’s ability to convert illicit gains into harder‑to‑track assets. For exchanges and users, the incident highlights the value of partnering with blockchain intelligence providers to enhance incident response capabilities.