On November 2, 2026, Mercado Bitcoin, the biggest cryptocurrency exchange in Brazil, faced a major security breach that resulted in a loss of over $49 million in cryptocurrencies across 17 blockchains. After receiving a notice from the exchange, Chainalysis immediately deployed investigators, working with stablecoin issuers and law enforcement authorities to track down the stolen funds.

Its action contributed to the freezing of around $10 million, including over $9 million in USDT. As teams keep an eye on the remaining funds and look for other chances to recover assets, the investigation is still ongoing.

Mercado Bitcoin Hack Drains $49 Million Across 17 Blockchains

Early on November 2, the attacker started transferring assets, depleting cryptocurrency in several waves across 17 blockchains. Estimates suggest that almost $49 million was stolen.

Chainalysis confirmed the event affected Brazil's largest cryptocurrency exchange and triggered a swift blockchain intelligence response. To identify and monitor the stolen assets, the company's detectives collaborated with Mercado Bitcoin, law enforcement, and business partners.

To study transaction flows and coordinate intervention activities, analysts from three continents joined a digital war room.

Chainalysis Mobilises Investigators Within 30 Minutes

A director of Mercado Bitcoin called Chainalysis's in-country solutions specialist at 2:30 am Eastern Time to report the security incident. By sharing a list of unauthorised transactions, the exchange made it possible for investigators to start mapping stolen money.

Chainalysis shared addresses that might contain assets that could be frozen with law enforcement within half an hour.

Three top priorities were the focus of the inquiry. Investigators searched for assets that might be blocked, identified and labelled stolen coins, and tracked their movements across blockchains. Additionally, they disseminated useful information to stablecoin issuers, law enforcement, and other industry partners who could take action.

Investigators were able to recover about $4 million in stolen stablecoins by morning. Coordination later on raised the total amount frozen to about $10 million.

Early this morning Mercado Bitcoin, Brazil’s largest crypto exchange, suffered a security incident that resulted in ~$49 million in stolen funds.

In the early hours of November 2 an attacker began moving assets held across 17 blockchains, working in waves to drain the estimated $49 million in various cryptocurrencies.

The first few hours of any hack are the most important for investigators. In that window of opportunity they can help freeze some assets, like centrally-issued stablecoins, before the attackers are able to convert them into harder-to-disrupt cryptocurrencies, like BTC and ETH.

We immediately mobilised our global team of investigators to lead the blockchain intelligence response, working closely with Mercado Bitcoin, law enforcement, and industry partners to help freeze nearly $10 million in stolen funds.

At 2:30 am ET a Mercado Bitcoin director phoned our in-country solutions expert with the news: the exchange had been hacked.

Within 30 minutes we made contact with law enforcement to relay freezable addresses.

By the time morning had arrived we had helped lock down stolen stablecoins. Our work led to millions of dollars in freezes in the hours that followed.

Over the course of this hack we communicated directly with Paxos, Anchorage Digital, Ripple, Circle, and Tether, working together with law enforcement to shut down stolen stablecoins.

Our investigators identified stolen funds held in USDT and rapidly traced them to addresses where the assets could potentially be frozen.

Using our established relationships with Tether and law enforcement, we escalated the relevant addresses and supporting intelligence, enabling Tether to take action and freeze over $9 million in stolen funds.

We’re continuing to trace the remaining funds, monitor their movement, and identify further opportunities for intervention.

— Chainalysis (@chainalysis) November 3, 2026

Tether Freezes More Than $9 Million in Stolen USDT

Tracing stolen USDT and finding wallet addresses where the tokens might be blocked was one of the biggest interventions.

Through their established connections with the stablecoin issuer and law enforcement, Chainalysis investigators forwarded the relevant addresses and supporting information to Tether. Tether was able to freeze almost $9 million in stolen funds as a result.

Paxos, Anchorage Digital, Ripple, Circle, and Tether were also directly contacted as part of the response. These groups collaborated with law enforcement and investigators to find ways to interfere with stolen stablecoins before hackers could turn them into more difficult-to-freeze assets.

The timing proved important because centrally issued stablecoins can be frozen by their issuers under applicable circumstances, whereas cryptocurrencies such as Bitcoin and Ethereum generally cannot be frozen through a similar issuer intervention.

Read our blog on disrupting the Mercado Bitcoin attack for further details: https://t.co/KD9Pw56SFw

— Chainalysis (@chainalysis) November 3, 2026

Investigation Continues as Stolen Crypto Moves Across Networks

According to Chainalysis, teams are still tracking down the remaining cash, keeping an eye on wallet movements, and searching for other chances to step in.

As the stolen assets were spread among several blockchain networks, detectives had to track transactions and locate addresses associated with the attack. Additionally, address labelling helps in keeping track of the flow of cryptocurrency that has been stolen.

The response shows how cooperation with stablecoin issuers, law enforcement coordination, and blockchain intelligence may assist in preventing cryptocurrency theft while assets are still recoverable.

In order to find more money that might be frozen while the attacker transfers the remaining assets, Chainalysis keeps providing relevant intelligence to partners who are ready to take action.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. Tampered Wallets Lead to $3.5M Losses
2. ICE Partners With Trade.xyz for Hyperliquid Futures
3. Canadian Teen Gets 25 Months for $13M Bitcoin Scam
4. BitMine ETH Holdings Rise as Tom Lee Targets $10K
5. Keystone Wallet Hack Raises Customer Privacy Concerns

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.