Mercado Bitcoin suffered a $48.6M hack across 10+ blockchains as attackers consolidated 31 altcoins and converted them into ETH.
Author: Akshay
4th November 2026 – The Mercado Bitcoin hack drained roughly $48.6 million from Brazil’s largest crypto exchange, according to on-chain investigator Bitquery. Attackers obtained valid signing credentials and emptied hot wallets across at least 10 blockchains.
High Signal Summary For A Quick Glance
𝗗𝗮𝘃𝗲𝗦𝘁𝗿𝗮𝘁𝗲𝗴𝗶𝘀𝘁 | Marketing & Growth
@DaveStrategist
@arkham Moving 31 different tokens into ETH is quite a rotation.
The Mercado Bitcoin Hacker has now moved 31 different alts to 0x848, and sold them all for $316K in ETH. He is continuing to move and sell altcoins at this address. Address: 0x84827Db93E1065Ff7CF192b4cb57ceC364d4317e https://t.co/b4GdMxUSss
08:35 AM·Nov 4, 2026
High attention and emotional sentiment detected.
The theft spanned Ethereum, Bitcoin, Solana, Stellar, Tron, Polygon, Arbitrum, Avalanche, and BNB Chain, among others. Within a few hours, the attacker also swept tens of thousands of customer deposit addresses. The exchange then paused deposits, withdrawals, and platform access while it investigated.
The main drain hit in a tight window of about 25 minutes. On-chain data places it near 06:24 to 06:50 UTC, which is early morning in Brasília.
During that window, the attacker moved funds out of hot wallets on chain after chain. According to Bitquery, Ethereum took the biggest hit at roughly $29.5 million. That haul included about 2,852 ETH, plus USDT, USDC, and around 185 other tokens.
Bitcoin ranked second, with about 106 BTC moved. The remaining chains then added roughly $10 million to $11 million combined. In total, Bitquery valued the loss at about $48.6 million at transfer time.
This was not a smart-contract exploit. Instead, the attacker signed ordinary transfers with valid credentials. On-chain, those transactions looked just like normal exchange activity.
Because the signatures were valid, there was no bug to patch and no transaction to reverse. That detail is consistent with compromised signing infrastructure rather than a flaw in any protocol.
Hours later, the attack widened. The exchange controlled the master keys for customer deposit addresses, so the attacker swept those too. On Ethereum alone, Bitquery counted roughly 35,853 to 36,042 swept deposit addresses.
Those deposit addresses all derived from one master key. As a result, a single compromise unlocked thousands of wallets at once. That structure is common at exchanges, yet this incident shows how sharply it can backfire.
Notably, much of that sweeping continued after the exchange announced containment around 12:56 UTC. As a result, the incident stretched well beyond the initial 25-minute drain.
After the drain, the attacker began consolidating and selling. By 3 to 4 November, blockchain intelligence firm Arkham was tracking the movement in near real time.
Arkham reported that the hacker moved 31 different altcoins to a single staging address, 0x84827Db93E1065Ff7CF192b4cb57ceC364d4317e. The attacker then sold them all for about $316,000 in ETH. You can watch the activity on Etherscan.
Earlier that day, Arkham also flagged about $11.45 million of altcoins moving out for sale. That batch included a $1.1 million transfer of VIRTUALS. The swaps mostly routed through MetaMask’s swap router, which pulls liquidity from major decentralized exchanges.
Most of the EVM funds funneled through a shared main address, 0xe485e7a70b1131216cb47ca4555c4bbb2c742478. From there, the attacker bridged and swapped in stages, likely to muddy the trail before any cash-out.
The 106 BTC, meanwhile, stayed put at the disclosed Bitcoin address during early tracking. So far, the attacker has left that larger prize untouched.
Mercado Bitcoin suffered a multi-chain security breach on November 2, 2026, with early estimates placing stolen assets near $48.6 million. Following emergency freezes and fund consolidation, the attacker continued liquidating assets. By November 4, Arkham reported that 31 different altcoins had been converted into approximately $316,000 in ETH, while broader attacker-controlled holdings remained in the tens of millions.
Attackers using valid signing credentials drain Mercado Bitcoin hot wallets across at least 10 blockchains, including Ethereum, Bitcoin, Solana, Stellar, Tron, Polygon, Arbitrum, Avalanche, and BNB Chain. The concentrated main drain lasts approximately 25–34 minutes. Bitquery estimates around $48.5–48.6 million was taken, including approximately $29.5–29.7 million on Ethereum, around 106 BTC, and more than $10 million across other chains. Early estimates from other trackers range from over $40 million to approximately $49 million.
Beyond the initial hot-wallet drain, the attacker sweeps tens of thousands of customer deposit addresses. Bitquery identifies approximately 35,853–36,042 Ethereum deposit addresses involved. The activity reportedly continues for hours after the exchange’s public containment announcement.
The exchange publicly confirms a security incident, stating that it has identified and contained the issue. It says customer funds have not been lost and no data breach occurred, while suspending deposits and withdrawals during the response.
Mercado Bitcoin shares key destination addresses to support monitoring of the stolen assets. The main Ethereum address is 0xe485e7a70b1131216cb47ca4555c4bbb2c742478, while the identified Bitcoin address is 19qGpsHvzh1t6pVi526XNNkh6hW6prDZp. Solana, Stellar, and Tron addresses are also disclosed.
Tether begins freezing suspected stolen assets around 10:21 UTC, followed by Circle, Paxos, and other participants. Tether CEO Paolo Ardoino initially confirms more than $4.5 million in frozen USDT. Chainalysis coordinates with partners as the investigation and asset-tracking effort expands.
The attacker consolidates assets into new wallets and begins bridging and swapping funds, including activity through Bridgers. Arkham tracks approximately $8 million in ETH moving to new wallets on November 3 as the laundering activity continues.
The exchange initially reports approximately $38 million in affected assets and around $11 million blocked through coordination involving Tether, Circle, Paxos, BRL1, and Chainalysis. A later update revises the figures to approximately $36.3 million affected and $12.9 million blocked. Mercado Bitcoin reiterates that customer balances are guaranteed, authorities have been notified, and the platform will remain paused until a safe restart is possible.
Arkham reports that the Mercado Bitcoin Hacker entity has moved approximately $11.45 million in altcoins to multiple addresses for potential sale. The attacker is also collecting ETH at another address: 0x469189223f286b51198163b4Eb5a1e532669523d.
Arkham reports that approximately $1.1 million in VIRTUALS has been moved to a new address and is being sold in smaller transactions. Around $1 million in VIRTUALS reportedly remains under the attacker’s control.
Arkham reports that the attacker has moved 31 different altcoins to staging address 0x84827Db93E1065Ff7CF192b4cb57ceC364d4317e and sold them for approximately $316,000 in ETH. On-chain activity shows repeated MetaMask Swap Router transactions converting tokens including DUSK, CVC, RLC, POL, BAL, NMR, and CTSI into ETH.
Further transactions remain active at the 0x84827… staging address. Arkham continues to track attacker holdings in the tens of millions across ETH, BTC, remaining altcoins, and stablecoins, with only a fraction of the overall assets frozen.
Mercado Bitcoin has stated that customer balances are guaranteed and that it will cover any shortfall. However, no fixed reopening date or formal reimbursement timetable has been announced. Monitoring continues for additional issuer freezes, law-enforcement action, further bridging or mixing attempts, and larger asset liquidations. The reported $316,000 ETH conversion represents only a small fraction of the overall stolen amount.
Recovery hinged on issuers, not on reversing the chain. Stablecoin providers can freeze tokens at the contract level, so partners moved fast to lock funds.
Tether confirmed freezing more than $4.5 million in USDT early on, and CEO Paolo Ardoino cited the action publicly. Circle and Paxos later joined, with Chainalysis helping coordinate the response.
Across those efforts, roughly $7.3 million to $11.4 million was frozen or blocked. The exchange later put its own blocked figure near $12.9 million. Still, most non-frozen funds remained under the attacker’s control.
The headline number depends on who is counting. Hypernative first flagged more than $40 million. Arkham estimated about $46 million, while Chainalysis put the figure near $49 million across up to 17 chains.
Mercado Bitcoin’s own updates landed lower, at roughly $38 million and later about $36.3 million affected. These gaps come from valuation timing, chain coverage, and whether dust tokens and frozen funds are counted.
Because of that, the Mercado Bitcoin hack is best described as a $40 million to $49 million event. The exact reconciled total is still not settled.
The exchange has been firm on one point. It says customers suffered no losses, since balances remain recorded and it will cover any shortfall from its own resources.
Mercado Bitcoin also stated that no customer data leaked during the incident. In addition, it notified the competent authorities and kept the platform paused pending a full security review.
For users, that guarantee matters more than the exact dollar figure. However, independent analysts note that on-chain movement continued after the “contained” announcement, so scrutiny remains high.
Several questions are still open. The precise root cause beyond “valid signatures” is unconfirmed, and the attacker’s identity is unknown.
Recovery now depends on further freezes and on whether law enforcement can trace the consolidated ETH. The reopening timeline also remains unclear, as the platform stays paused for now.
For readers tracking the Mercado Bitcoin hack, the live trail runs through Arkham and Etherscan. This is not financial advice, but the case is a sharp reminder to weigh custody risk when leaving funds on any exchange.
Our Crypto Talk is committed to unbiased, transparent, and true reporting to the best of our knowledge. This news article aims to provide accurate information in a timely manner. However, we advise the readers to verify facts independently and consult a professional before making any decisions based on the content since our sources could be wrong too. Check our Terms and conditions for more info.
CZ Slams Binance Hack Security Failures in $6.4B Heist
Mercado Bitcoin Hack Drains ~$48.6M Across 10 Chains
Mercado Bitcoin Hacker Moves $8M ETH Eyes Tornado Cash
Binance Hacker Sends $4M to Nested Services, Arkham Says
CZ Slams Binance Hack Security Failures in $6.4B Heist
Mercado Bitcoin Hack Drains ~$48.6M Across 10 Chains
Mercado Bitcoin Hacker Moves $8M ETH Eyes Tornado Cash
Binance Hacker Sends $4M to Nested Services, Arkham Says
