Disrupting the Mercado Bitcoin Attack: How Chainalysis Led the Freeze of Nearly $10M in Stolen Funds

Early this morning Mercado Bitcoin, Brazil’s largest crypto exchange, suffered a security incident that resulted in approximately $49 million in stolen funds. As a Chainalysis customer, Mercado Bitcoin alerted our team in the early hours of the incident. We immediately mobilised our global team of investigators to lead the blockchain intelligence response, working closely with Mercado Bitcoin, law enforcement, and industry partners to help freeze nearly $10 million in stolen funds.

Chainalysis analysts from three continents logged into our digital war room to discuss the flow of funds and coordinate a response plan.

Our team focused on three immediate priorities:

• Identify, trace, and label stolen assets, establishing the initial movement of funds and making relevant intelligence available through Chainalysis products.
• Identify opportunities for intervention, prioritising assets that could potentially be frozen or otherwise secured.
• Coordinate action with external partners, rapidly disseminating actionable intelligence to law enforcement, stablecoin issuers, and other relevant organisations.

How the attack happened

In the early hours of November 2 an attacker began moving assets held across 17 blockchains, working in waves to drain an estimated $49 million in various cryptocurrencies. The largest tranches came from Bitcoin and Ethereum, but assets on smaller blockchains, like Base, Tron, and Polygon, were also swept.

How Chainalysis responded to the hack

The first few hours of any hack are the most important for investigators. In that window of opportunity they can help freeze some assets, like centrally-issued stablecoins, before the attackers are able to convert them into harder-to-disrupt cryptocurrencies, like BTC and ETH.

For that reason, Chainalysis investigators worked from Hour 0 researching what assets had been taken, which of those assets could be frozen, and who outside the company needed to know it.

At 2:30 am Eastern Time a Mercado Bitcoin director phoned our in-country solutions expert with the news: the exchange had been hacked. He shared with our expert a list of the unauthorized transactions, and our investigator began mapping it out.

Within 30 minutes we made contact with law enforcement to relay freezable addresses. Before long we were also in communication with stablecoin issuers, helping them understand opportunities to disrupt the theft. By the time morning had arrived we had helped lock down $4 million in stolen stablecoins. Over the coming hours our work led to millions of dollars more in freezes.

Over the course of this hack we communicated directly with Paxos, Anchorage Digital, Ripple, Circle, and Tether, working together with law enforcement to shut down stolen stablecoins issued by them.

For example, our investigators identified stolen funds held in USDT and rapidly traced them to addresses where the assets could potentially be frozen. Using our established relationships with Tether and law enforcement, we escalated the relevant addresses and supporting intelligence, enabling Tether to take action and freeze over $9 million in stolen funds.

This was not simply a case of tracing assets on the blockchain. It required our investigators to identify an opportunity for intervention, understand which organisations could act, and rapidly coordinate the necessary response.”

What happens next

Our involvement doesn’t stop with the initial freezes. We’re continuing to trace the remaining funds, monitor their movement, and identify further opportunities for intervention.

The funds will keep moving and labeling addresses tied to the theft helps keep that activity visible. By sharing relevant intelligence with partners positioned to act, we can help the wider ecosystem recognize stolen funds and respond as they move.

This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.

This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.

Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.