Disrupting the Mercado Bitcoin Attack: How Chainalysis Led the Freeze of Nearly $10M in Stolen Funds

Incident Overview

Mercado Bitcoin, Brazil’s leading crypto exchange, reported a security breach on November 2 that resulted in an estimated $49 million being siphoned across 17 blockchains. The attack spanned major assets such as Bitcoin and Ethereum as well as smaller chains like Base, Tron and Polygon. Chainalysis, a longtime client of the exchange, was alerted early and immediately activated its global investigative team.

Methodology and Immediate Priorities

Chainalysis analysts from three continents entered a digital war‑room to map the flow of stolen funds. Their three‑fold agenda was to (1) label and trace the illicit assets, (2) pinpoint opportunities where the assets could be frozen, and (3) coordinate with external partners—including law‑enforcement, stablecoin issuers and custodians—to act on that intelligence. Within 30 minutes of the initial call, the team shared freezable addresses with authorities and began outreach to stablecoin providers.

Key Findings and Actions

By the time morning arrived, Chainalysis had helped lock down $4 million in stolen stablecoins. Continued monitoring and collaboration with firms such as Paxos, Anchorage Digital, Ripple, Circle and Tether expanded the freezes. Notably, the firm’s investigators traced USDT holdings to addresses that could be acted upon, prompting Tether to freeze over $9 million. In total, the coordinated effort resulted in the immobilisation of nearly $10 million of the stolen proceeds, representing roughly one‑fifth of the total loss.

Caveats and Ongoing Work

The report stresses that the response is not a one‑time event. Funds continue to move, and Chainalysis is still tracking the remaining assets, labeling addresses and sharing intelligence with partners capable of intervening. The figures cited are based on the information available at the time of writing and may evolve as further tracing occurs.

Implications for the Crypto Ecosystem

The case underscores the importance of rapid, cross‑industry collaboration when a breach occurs. Early identification of freezable stablecoins can significantly limit an attacker’s ability to convert illicit gains into harder‑to‑track assets. For exchanges and users, the incident highlights the value of partnering with blockchain intelligence providers to enhance incident response capabilities.