Blockchain analytics firm Bitquery tracked approximately 6.7 million Stellar (XLM) tokens to a wallet implicated in the recent security breach at Mercado Bitcoin, Brazil’s leading cryptocurrency exchange. Investigators uncovered evidence that the theft spanned at least ten different blockchain networks and involved a range of digital assets.
Stellar Wallet Holds 6.7 Million XLM After Mercado Bitcoin Attack
On November 2, Mercado Bitcoin disclosed a security incident and suspended all deposits and withdrawals to investigate unauthorized transactions. The exchange, a top regional trading platform for digital assets in Latin America, subsequently released a list of destination wallet addresses on various networks, including Stellar, Bitcoin, Solana, Tron, and Ethereum-compatible blockchains. This move aimed to support the efforts of blockchain investigators in tracking suspicious activity and freezing assets where possible.
Following the breach, Bitquery identified the attacker’s Stellar address as holding about 6.71 million XLM and 979,527 USDC. Meanwhile, initial assessments from security company Hypernative pointed to suspicious transfers exceeding $40 million. Later analysis raised the estimated assets leaving Mercado Bitcoin-linked wallets to $48.5 million.
Hypernative’s review revealed that the attacker managed to obtain approximately 106 BTC, 2,852 ETH, 10,700 SOL, and the 6.7 million XLM, all moved from the exchange in a coordinated operation. The majority of these transfers took place in a concentrated time span between 06:19 and 06:53 UTC, suggesting precise execution across several different blockchain ecosystems.
A significant portion of the suspected theft, approximately $29.5 million, was traced to Ethereum transactions, making it the largest segment of the breach. The event follows a series of high-profile cross-network incidents, such as the recent case involving Binance, though investigators have not found any evidence linking the Mercado Bitcoin attack to other recent breaches.
| Asset | Estimated Value | Blockchain Network |
|---|---|---|
| 106 BTC | – | Bitcoin |
| 2,852 ETH | – | Ethereum |
| 10,700 SOL | – | Solana |
| 6.7 million XLM | – | Stellar |
Mini dictionary: Bitquery – A blockchain analytics platform that helps track, investigate, and analyze digital asset flows across multiple blockchain networks through its data-driven tools.
Mercado Bitcoin Says Customer Funds Remain Protected
Mercado Bitcoin has assured that no customer funds were lost in the incident and clarified that client data remained secure. The exchange, which is also engaged in institutional blockchain solutions and tokenization initiatives, has not disclosed the total value lost or provided details on how hackers obtained transaction-signing powers over its wallets.
Clients did not experience financial losses and no personal information was compromised, according to Mercado Bitcoin’s official clarification. The company continues to work with investigators and partner networks to monitor and recover transferred assets.
Mercado Bitcoin has been prominent in the tokenization field, announcing a $200 million project on the XRP Ledger and later securing a $20 million investment from stablecoin issuer Tether. However, investigators emphasized there is no evidence suggesting these associated blockchain platforms were impacted by the security incident at the exchange.
Mini dictionary: Mercado Bitcoin – Established in 2013, Mercado Bitcoin is the largest cryptocurrency exchange in Brazil, providing trading and blockchain services to individual and institutional clients across Latin America.
Stablecoin Freezes Complicate Recovery of Stolen XLM
Investigators from firms such as Chainalysis are working concurrently with companies like Ripple, Tether, and Circle to identify and recover as many stolen assets as possible. In these efforts, more than $9 million in USDT has been frozen as attempts are made to stem the outflow of funds. These interventions resemble previous asset recovery actions using stablecoin issuer controls after prominent breaches, including Binance’s security incident earlier this year.
More than $9 million in USDT associated with the breach has been frozen through coordination with stablecoin companies, providing a significant step towards asset recovery.
Unlike centralized stablecoins, however, Stellar’s native XLM tokens cannot be frozen unilaterally by an issuer. This structural difference makes asset recovery particularly challenging and increases the need for closer exchange collaboration and ongoing transaction surveillance to intercept stolen XLM. The incident highlights the broader issue of transparency and risk management in the rapidly evolving digital asset sector.
