Mercado Bitcoin, Brazil’s largest cryptocurrency exchange, suffered a security incident on November 2 that resulted in the theft of approximately $49 million in digital assets. The attack involved an adversary moving funds across 17 different blockchains, with the largest portions drained from Bitcoin and Ethereum networks, alongside assets on Base, Tron, and Polygon.
Chainalysis, acting as a customer service provider for Mercado Bitcoin, mobilized its global investigative team immediately after being alerted by the exchange. Within 30 minutes of receiving unauthorized transaction data at 2:30 am Eastern Time, Chainalysis contacted law enforcement to relay addresses associated with freezable assets. The firm coordinated with stablecoin issuers including Paxos, Anchorage Digital, Ripple, Circle, and Tether to disrupt the movement of stolen funds.
Through this collaborative effort, nearly $10 million in stolen assets were frozen. A significant portion of this recovery involved tracing USDT holdings and escalating intelligence to Tether, which subsequently froze over $9 million. Chainalysis continues to monitor the remaining funds, labeling addresses tied to the theft to maintain visibility on asset movements and identify further intervention opportunities.
The rapid coordination between blockchain analytics firms, exchanges, and stablecoin issuers demonstrates the critical role of centralized chokepoints in mitigating crypto theft. By leveraging established relationships with entities like Tether and Circle, investigators can freeze assets before they are converted into harder-to-trace cryptocurrencies like Bitcoin or Ethereum. This case highlights how the initial hours post-incident are decisive, where speed of information sharing directly correlates with the volume of recoverable funds.
However, the reliance on issuer cooperation underscores a structural vulnerability in decentralized finance protocols that lack such centralized controls. While effective for stablecoins, this strategy does not protect assets held in native tokens on non-custodial chains unless those assets are moved through regulated on-ramps. The incident serves as a reminder that while regulatory frameworks and industry partnerships can limit losses, they cannot fully secure assets against sophisticated multi-chain exploits without broader protocol-level safeguards.
