The hacker responsible for the recent Mercado Bitcoin security incident has sold around $10.55 million worth of stolen altcoins for Ethereum, according to blockchain analytics company Arkham. On November 4, Arkham observed that the attacker continued to move funds through newly created wallets, while an effort to transfer part of the stolen assets into Bitcoin appeared to be blocked.
Attacker’s Wallet Movements and Token Swaps Detailed
Arkham reported that wallets attributed to the hacker transferred approximately $13.26 million in tokens and ETH to 23 external addresses over a 24-hour period. Of these, 22 addresses were newly generated specifically for this purpose. The tokens were then sold on the market, with notable sales including $1.82 million in PEPE, $1.65 million in AAVE, and $1.14 million in VIRTUAL tokens. These amounts reflect Arkham’s monitoring of blockchain activity, though the final scale of stolen assets could change as investigations continue.
Arkham identified that the attacker’s wallets swapped the stolen altcoins for native ETH using MetaMask Router, conducting 338 transactions which produced 4,605 ETH valued at about $10.55 million. Additional funds received included roughly $818,000 in mUSD and $104,000 in USDC.
The continued dispersal of tokens into a large number of new addresses has made tracking the flow of assets increasingly complex, as the conversion to ETH helps obscure the origin of funds. While the disposal of substantial amounts of several altcoins has increased selling activity in those individual assets, Arkham did not assess a wider market impact.
| Asset | Amount Sold |
|---|---|
| PEPE | $1.82 million |
| AAVE | $1.65 million |
| VIRTUAL | $1.14 million |
| mUSD | $818,000 |
| USDC | $104,000 |
| Total ETH Swapped | 4,605 ETH ($10.55 million) |
Bridge Transfer to Bitcoin Halted
Arkham also noted that an attempt to move $650,000 of the stolen assets into Bitcoin through a bridging service named Bridgers was interrupted. It remains unclear who intervened or whether the funds have been recovered, but the halt suggests that some cross-chain transfers may now face greater scrutiny or countermeasures.
The attacker initially targeted assets on at least 10 different blockchains. By distributing tokens across new addresses and converting them into ETH, the hacker complicated asset tracking efforts and intensifying the investigation being conducted by analytics and exchange teams.
Mini dictionary: Arkham is a blockchain analytics firm specializing in tracking and analyzing digital asset movements, often assisting exchanges and law enforcement agencies in identifying suspicious activities and hacking incidents.
Exchange Statements and Customer Security
Mercado Bitcoin, one of the leading cryptocurrency exchanges in Brazil, confirmed that its hot wallets were affected in the incident but assured customers that their assets remain secure. In a statement dated November 2, the company said it temporarily took the platform offline, reported the breach to law enforcement, and notified both asset issuers and security partners. At that stage, Mercado Bitcoin had managed to freeze around $11 million of the compromised assets, while approximately $38 million had not been recovered.
Mercado Bitcoin communicated that deposits and withdrawals were temporarily paused as its teams investigated the breach and worked to contain further losses. Official updates from the exchange remain the main reference point for the operational status and recovery efforts.
There has not yet been confirmation that the platform’s full range of services has resumed or that the entirety of the stolen funds has been recovered. Mercado Bitcoin continues to monitor the situation and coordinate with authorities.
Regulatory Developments in Brazil
The incident comes during a significant regulatory overhaul in Brazil’s crypto sector. The country’s central bank is rolling out Resolution BCB 520, which from February 2026 will require virtual asset service providers to enforce rigorous controls over custody, cybersecurity, and governance, and implement protocols for responding to security breaches. These rules also stipulate robust protections for customer funds and private keys against unauthorized access.
The Mercado Bitcoin breach has brought renewed attention to the importance of safeguarding hot wallets, which are used for frequent transaction processing. Exchange representatives indicated that the majority of customer funds are maintained in offline storage, limiting exposure during such incidents. Industry observers are now watching closely for any additional asset freezes, potential fund recoveries, the reopening of exchange operations, and updates from investigators about how unauthorized wallet access was gained.
