On November 2, 2026, an attacker withdrew funds from hot wallets belonging to Brazilian crypto exchange Mercado Bitcoin, then swept funds from thousands of customer deposit addresses. Early reporting put losses at around $40 million. A broader investigation covering 17 blockchains put the estimate closer to $49 million. The final loss remains unconfirmed. Investigators covered different networks, valued assets at different times, and tracked withdrawals over different periods.
Mercado Bitcoin suspended withdrawals and published addresses that received stolen funds. Merkle Science reviewed addresses across 13 blockchains. We identified a single address that received assets on nine networks and traced how the attacker divided the proceeds among holding wallets. We also identified a later transfer that moved funds from Solana to Ethereum.
The earliest activity investigators linked to the attacker occurred at approximately 18:21 UTC on November 1. Small transfers reached Ethereum and Tron addresses that later received stolen funds. These may have been preparatory transactions. The timing of the initial compromise remains unknown.
The first reported unauthorized withdrawal came at approximately 01:22 UTC on November 2, beginning with a small test transaction on Base. Over the next several hours, withdrawals appeared on Optimism, Arbitrum, Cronos, Linea, Scroll, Flare, and Mantle. These early withdrawals totaled approximately $284,000.
The largest wave of hot wallet withdrawals occurred between 05:42 and 06:49 UTC. At approximately 06:24 UTC, Mercado Bitcoin’s main Ethereum hot wallet sent 2,852 ETH to an attacker-controlled address. Nearly 190 additional token transfers followed. At 06:41 UTC, a separate Bitcoin transaction moved 104.43 BTC using 34 inputs. Investigators also identified withdrawals on Solana, Stellar, Tron, Avalanche, Polygon, Arbitrum, XDC, and BNB Chain during the incident.
Ethereum accounted for the largest reported losses at $29.6 million, followed by Bitcoin at $8.3 million and Solana at $3.5 million. The graphic shows rounded estimates from an independent on-chain investigation, with address attribution supported by Merkle Science. The figures reflect asset prices at approximately 06:30 UTC on November 2.
At approximately 12:27 UTC, independent investigators identified another wave of transfers. This time, the funds came from addresses ordinarily used to receive customer deposits. Roughly 27,160 addresses sent a combined 34.7 ETH in 56 minutes. Further stablecoin transfers involved hundreds of additional addresses.
The timing and volume suggest that the attacker used an automated process to initiate transactions from a prepared list of addresses. The ability to move funds from both hot wallets and deposit addresses points to possible access to Mercado Bitcoin’s wallet-signing or transaction authorization systems. The exchange has not confirmed how the attacker authorized the withdrawals.
The same attacker-controlled address, 0xe485e7A70b1131216Cb47CA4555c4Bbb2C742478, received assets on nine Ethereum Virtual Machine (EVM) networks. These were Ethereum, BNB Chain, Polygon, Arbitrum, Optimism, Avalanche, Linea, Base, and Cronos. The attacker used separate receiving addresses on non-EVM networks.
On Ethereum alone, the receiving wallets accumulated more than 180 distinct tokens, including stablecoins, governance tokens, and memecoins. The attacker then grouped some of the holdings by token type and transferred them to newly created wallets. Public investigations by Arkham Intelligence and Bitquery also examined the movement of the stolen funds.
Independent tracing identified a wallet that received approximately $4.3 million in PEPE, AAVE, FET, INJ, and other tokens. A separate wallet received approximately 2.24 million USDC. Other addresses received smaller groups of tokens, including LINK, LDO, WBTC, SHIB, and POL. The attacker also split ETH among several addresses.
The initial withdrawals on Bitcoin, Solana, Stellar, and Tron came directly from Mercado Bitcoin wallets on those networks. That distinction matters when tracing the theft. Finding stolen assets on several blockchains does not, by itself, establish that the attacker bridged funds between them.
Investigators did identify a later cross-chain transfer through Mayan. Funds moved from Solana and arrived as ETH on Ethereum. Newly created Ethereum addresses then forwarded the proceeds to other attacker-associated addresses, often within minutes.
On Solana, the attacker also converted memecoins and other tokens into stablecoins. Independent investigators traced approximately 10,690 SOL distributed across seven wallets and identified USDT transfers through additional intermediary addresses.
Stablecoin issuers began restricting affected balances within hours. Tether blacklisted attacker-associated USDT holdings on Ethereum and Tron. Investigators subsequently observed USDT restrictions on Solana and reported freezes affecting USDC and USDT0 on Polygon.
By approximately 16:20 UTC on November 2, one independent investigation had identified about $6.2 million in frozen stablecoins. The largest amount was on Ethereum, where approximately $3.06 million in USDT had been frozen.
At the same cutoff, the investigation identified approximately $3.6 million in additional stablecoins that remained unfrozen, including USDC on Ethereum and Stellar and EURC on Ethereum. The restrictions limited transfers of specific assets. The attacker could still move other holdings.
The sweep of roughly 27,160 customer deposit addresses raises a question that the hot wallet withdrawals alone cannot answer. How did the attacker gain the ability to authorize transactions from so many exchange-controlled addresses? The coordinated withdrawals suggest a possible common point of compromise in Mercado Bitcoin’s wallet infrastructure. The underlying mechanism remains unconfirmed.
As of November 3, Merkle Science had not identified any confirmed deposits from the attacker addresses we reviewed into a known centralized exchange. We will continue tracing transfers from the original receiving addresses and the wallets used to hold or convert the proceeds.
To screen wallet addresses or assess exposure to funds stolen in the Mercado Bitcoin hack, contact Merkle Science.
