In the early hours of November 2, Mercado Bitcoin, the largest cryptocurrency exchange in Brazil, suffered a sophisticated security incident that resulted in the unauthorized outflow of approximately $49 million in digital assets. As a long-standing customer of the blockchain intelligence firm Chainalysis, Mercado Bitcoin immediately alerted the company’s incident response team. Within minutes of the notification, a global mobilization was underway. Chainalysis deployed a multi-continental team of investigators to lead the technical blockchain response, working in close collaboration with Mercado Bitcoin, international law enforcement agencies, and major industry partners to trace the stolen assets and successfully freeze nearly $10 million before the funds could be fully laundered or converted.
The rapid mobilization demonstrated the critical role that real-time blockchain analytics and cross-industry collaboration play in modern cybersecurity incident response within the digital asset sector. As analysts from three different continents logged into a centralized digital war room, the primary objective was clear: establish an immediate communication channel with key stakeholders, map out the complex web of unauthorized transactions, and identify actionable opportunities to disrupt the attackers before they could consolidate their gains across privacy-enhancing protocols or harder-to-track networks.
How the Attack Happened
The security breach began unfolding in the early hours of November 2, when an unauthorized actor initiated a coordinated series of transactions designed to drain funds from Mercado Bitcoin. Operating in waves, the attacker targeted assets held across 17 distinct blockchains, illustrating a high degree of technical preparation and cross-chain operational capability.
While the largest financial tranches originated from major, highly liquid networks such as Bitcoin and Ethereum, the attacker systematically swept assets from smaller or alternative blockchains as well, including Base, Tron, and Polygon. The diversity of the targeted networks presented an immediate operational challenge for investigators, requiring specialized tracking capabilities across multiple disparate ledger systems simultaneously.
By the time the initial wave of the attack subsided, an estimated $49 million in various cryptocurrencies had been siphoned from the platform. The sheer scale and multi-chain nature of the breach meant that traditional reactive security measures alone would be insufficient, necessitating an aggressive, coordinated intervention across the broader cryptocurrency ecosystem to mitigate total losses.
How Chainalysis Responded to the Hack
In the digital asset industry, the first few hours following a major security breach represent the most critical window of opportunity for investigators, asset recovery teams, and law enforcement agencies. During this initial timeframe, security professionals possess a narrow window to coordinate with centrally-issued stablecoin operators and centralized exchanges to freeze compromised assets. Once attackers successfully convert these traceable tokens into decentralized or harder-to-disrupt cryptocurrencies—such as native Bitcoin or Ether—recovering or freezing the funds becomes exponentially more difficult.
Recognizing the urgency of the situation, Chainalysis investigators operated from what they designated as "Hour 0," immediately researching the specific assets that had been compromised, determining which of those tokens possessed freezing capabilities, and identifying the external organizations that needed to be notified to enact emergency interventions.
The critical turning point occurred at 2:30 a.m. Eastern Time, when a director at Mercado Bitcoin telephoned an in-country solutions expert at Chainalysis to break the news of the breach. The exchange representative immediately shared a comprehensive list of the unauthorized transactions with the firm’s expert, who began mapping the illicit fund flows within minutes.
Within half an hour of receiving the transaction data, Chainalysis made direct contact with law enforcement agencies to relay actionable, freezable wallet addresses. Simultaneously, the team established communication channels with prominent stablecoin issuers, helping them understand the mechanics of the theft and outlining immediate opportunities to disrupt the illicit transfers.
By the time morning arrived in the Americas, this swift coordination had already led to the successful lockdown of $4 million in stolen stablecoins. As the investigation continued to progress over the subsequent hours, sustained pressure and rapid intelligence-sharing ultimately pushed the total value of frozen assets to nearly $10 million.
Throughout the unfolding crisis, Chainalysis maintained direct communication channels with key industry stakeholders, including Paxos, Anchorage Digital, Ripple, Circle, and Tether. By working in tandem with law enforcement and these issuing entities, the investigative team was able to effectively shut down stolen stablecoins across multiple platforms.
For instance, Chainalysis investigators identified significant amounts of stolen funds held in Tether (USDT) and rapidly traced the assets to specific wallet addresses where freezing mechanisms could theoretically be applied. Leveraging established operational relationships with both Tether and law enforcement agencies, the investigators escalated the relevant addresses along with supporting blockchain intelligence. This timely escalation enabled Tether to take immediate administrative action, resulting in the successful freezing of over $4 million in stolen USDT.
Industry experts noted that mitigating such a complex breach required far more than basic blockchain tracing. The operation demanded that investigators proactively identify actionable intervention points, understand the specific legal and technical authorities of various organizations, and execute a synchronized response across international borders in a matter of hours.
What Happens Next
While the initial wave of asset freezes represents a significant tactical victory for Mercado Bitcoin and the broader security community, the work of the investigative team is far from finished. Chainalysis has confirmed that its involvement extends well past the immediate aftermath of the hack.
Investigators are continuing to trace the remaining un-frozen funds, monitoring their movement across the various blockchains involved, and identifying further opportunities for intervention as the attacker attempts to move or obfuscate the capital. Because stolen funds frequently circulate through various intermediary wallets and mixing services in an effort to evade detection, maintaining continuous visibility over the tainted addresses remains essential.
By consistently labeling addresses tied to the theft and sharing relevant, up-to-date intelligence with trusted partners who are positioned to act, security firms and exchanges can help the wider ecosystem recognize stolen assets in real time. This ongoing vigilance ensures that as the remaining funds move across the network, exchanges, custodians, and compliance teams retain the necessary visibility to block illicit deposits, ultimately narrowing the operational space available to malicious actors in the digital asset economy.
Crypto Wallets & Security
Crypto Wallets & Security
Crypto Wallets & Security
