Mercado Bitcoin Hacker Moves $8M ETH Eyes Tornado Cash

High attention and emotional sentiment detected.

Arkham flagged the move around 06:25 UTC on November 3. The largest single transfer was about 2,900 ETH, worth roughly $6.52 million, alongside smaller 470 and 200 ETH transfers. The attributed wallet still holds about $46 million in crypto.

The shift reignited one question analysts keep asking. Will the Mercado Bitcoin hacker route these funds into Tornado Cash next?

Hacker Moves $8M in ETH to New Wallets

The fresh transfers do not cash out the funds. Instead, they fragment them away from the original hot-wallet-linked address. Analysts call this a classic first laundering step.

Moving to new wallets reduces immediate monitoring pressure. After that, an attacker typically weighs mixing, bridging, or depositing into an exchange. Arkham reported no Tornado Cash deposit as of its November 3 post.

Arkham values the attributed holdings near $46 million. That stash includes roughly $8.37 million in ETH, about $8.24 million in BTC, and around $1.76 million in PEPE. The wallets also hold USDT, USDC, AAVE, and PENDLE.

The attacker also dumped smaller tokens along the way. On-chain analysts reported sales of assets such as RENDER and WIF during the first day. So the final portfolio keeps shifting as the attacker trims positions.

How the Mercado Bitcoin Hack Unfolded

Mercado Bitcoin, founded in 2013, is Brazil’s largest crypto exchange. It serves about 4.5 million users and recently took a $20 million investment from Tether.

Early on November 2, an attacker gained unauthorized access to one of the exchange’s systems. The breach was not a smart-contract exploit. Instead, it enabled plain transfers out of hot wallets across at least 10 to 17 blockchains.

The first major outflow came around 06:24 UTC. The attacker moved about 2,852 ETH, worth roughly $6.52 million. Soon after, roughly $2.99 million in USDT and $2.24 million in USDC followed, then about 104.43 BTC near 06:41 UTC.

The waves of drains ran fast. Most of the main hot-wallet activity happened inside a window of roughly 25 to 67 minutes. The speed points to compromised signing keys rather than a slow, manual theft.

The Attacker Swept Thousands of Deposit Addresses

The hot wallets were only part of the damage. The attacker also swept thousands of customer deposit addresses across multiple chains.

Blockchain firm Bitquery counted 35,853 drained deposit addresses on Ethereum alone. The sweeping reportedly continued even after the exchange said it had contained the incident.

Mercado Bitcoin later published the destination addresses to help trackers. The main EVM address is 0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478, and the Bitcoin address is 19qGpsHvzh1t6pVi526XNNkh6hW6prDZp. The exchange also shared Solana, Stellar, and TRON addresses tied to the flows.

Estimates of the Stolen Total Diverge

The total stolen remains contested, and estimates vary by source. Early reports from security firm Hypernative put the figure above $40 million.

Arkham tracks about $46 million in holdings. Bitquery estimated $48.5 million across 10 chains. Chainalysis reported close to $49 million across 17 chains.

Mercado Bitcoin gave a lower number. The exchange said the incident involved roughly $38 million in assets, with about $11 million frozen. The gap mostly reflects timing, chain coverage, and holdings versus net loss after freezes.

Tether and Partners Freeze Millions

Response teams moved quickly. Tether chief executive Paolo Ardoino said the company froze more than 4.5 million USDT tied to the incident early on.

Freezes later climbed toward $9 million to $11 million. Chainalysis said it helped freeze nearly $10 million, working with partners including Circle and Paxos. According to Chainalysis, coordination started within hours of the first outflows.

Mercado Bitcoin, meanwhile, pledged to cover all user losses. In an official statement, the exchange said there was no harm to customers and no data leak. Deposits and withdrawals stayed suspended while recovery continued.

Will the Funds Reach Tornado Cash?

Tornado Cash is a non-custodial Ethereum mixer. It uses zero-knowledge proofs and fixed-size pools, so depositors can withdraw to fresh addresses with no obvious link to the source.

Hackers often use such tools to break simple tracing before cashing out. The U.S. Treasury sanctioned Tornado Cash in 2022, then delisted it in March 2025 after a court ruling. So its use today still invites scrutiny, even though it no longer sits on the sanctions list.

Analysts had not seen a deposit from the attributed wallets at report time. They simply flagged the risk. The $8 million ETH move may be a staging step before any mixing attempt.

What the Mercado Bitcoin Hack Means Next

The breach landed just days after a record roughly $6 billion Binance hack. Together, the two events sharpen scrutiny of exchange key management and hot-wallet security.

For now, the on-chain picture matters more than the market one. ETH traded around $2,250 to $2,270 on November 3, so an $8 million move barely dents daily volume. On-chain, though, every transfer from this wallet draws analyst attention.

Watchers will track whether the hacker bridges, mixes, or sits on the funds. Anyone can follow the flow directly on Etherscan. This article is informational only and is not financial advice.