TLDR
- The Mercado Bitcoin hacker moved about $8 million in Ethereum to new wallets on November 3.
- Arkham asked whether the ETH could reach Tornado Cash, but no deposit has been confirmed.
- The attacker still holds over $1 million each in several altcoins, including PEPE, AAVE and ONDO.
- Tether froze more than $9 million linked to the attack after Chainalysis coordinated with issuers.
- The breach came four days after a separate $6.3 billion hack at Binance.
The hacker behind the $46 million Mercado Bitcoin breach has moved about $8 million worth of Ethereum to new wallets. Blockchain analytics platform Arkham reported the transfers on November 3.
The transactions came one day after the attack on Brazil’s largest cryptocurrency exchange. The breach affected wallets across at least ten blockchains and led the exchange to pause deposits and withdrawals.
According to Arkham’s records, the attacker has been spreading stolen Ethereum across several addresses tied to the breach. The largest transfer involved about 2,900 ETH, valued at $6.52 million.
Smaller transactions of 470 ETH and 200 ETH were also recorded. Together, these moves make up the roughly $8 million in ETH transfers flagged by the firm.
Arkham raised the question of whether the ETH could end up in Tornado Cash. Tornado Cash is a crypto mixing protocol that makes it harder to trace links between sending and receiving wallets.
So far, the transfers in Arkham’s update only involved wallets linked to the attacker. No deposits into Tornado Cash have been confirmed.
Hacker Still Holds Millions in Altcoins
Blockchain tracker Lookonchain reported that the attacker still holds several altcoins worth more than $1 million each. These include about 372.99 billion PEPE tokens valued at $1.79 million.
Other holdings include 12,820 AAVE worth $1.61 million and 769,950 PENDLE worth $1.35 million. The wallet also holds 29,830 EVA valued at $1.26 million.
The attacker also holds about 1.98 million VIRTUAL tokens worth $1.15 million and 147,840 UNI worth $1.04 million. Another 2.67 million ONDO tokens are valued at $1.03 million.
Lookonchain warned that these altcoins could face selling pressure if the attacker sells them. Arkham has already tracked 287 token swaps from the attacker’s wallets, including sales of RENDER, WIF, KMNO and POPCAT.
More Than $9 Million in Stolen Crypto Frozen
Investigators, law enforcement and crypto issuers have worked together to freeze part of the stolen funds. In a November 2 report, Chainalysis said its team worked directly with Mercado Bitcoin after the exchange reported the incident.
Chainalysis contacted law enforcement within 30 minutes of finding addresses holding assets that could be frozen. The firm said it coordinated with Tether, Paxos, Circle, Ripple and Anchorage Digital.
About $4 million in stablecoins was secured in the first response. Tether later froze more than $9 million in assets linked to the attack.
The breach began on November 2 when an attacker gained unauthorized access to one of Mercado Bitcoin’s systems. The exchange said it had contained the incident and that customers suffered no harm or data breach.
Arkham’s data showed the attacker first moved 2,852 ETH worth about $6.52 million from an exchange hot wallet. This was followed by $2.99 million in USDT, $2.24 million in USDC and about 104.43 BTC valued at $8.16 million.
A separate Bitquery investigation estimated that about $48.5 million left exchange wallets across ten blockchains. Bitquery also found more Ethereum transactions after the exchange said the incident was contained.
Mercado Bitcoin later published the destination addresses on Ethereum-compatible networks, Bitcoin, Solana, Stellar and Tron. The list is meant to help investigators track the stolen assets.
The attack came four days after Binance suffered a separate breach on October 29 that resulted in about $6.3 billion in stolen crypto. By November 1, Binance said it had replenished 95% of affected assets and resumed Bitcoin withdrawals.
As of November 3, Arkham data shows the attacker still controls a crypto portfolio worth roughly $46 million. Investigators continue to monitor transfers and look for more assets that may be recovered.
