Mercado Bitcoin Hacker Moves $8M in ETH — Tornado Cash?

Mercado Bitcoin hacker shifts $8M in ETH as investigators track stolen funds

On November 2, a sophisticated attacker breached Mercado Bitcoin, Brazil's largest crypto exchange, extracting funds across at least ten blockchains. Since the incident, blockchain analytics firms have traced repeated movements of the stolen assets. Arkham Intelligence reported that the hacker recently moved roughly $8 million worth of Ethereum (ETH) into new addresses, prompting renewed concerns about where the funds might be laundered next — and whether a privacy mixer like Tornado Cash could play a role.

What the newest transfers reveal

Arkham’s on-chain analysis shows consecutive ETH transfers attributed to the attacker. The largest single movement was approximately 2,900 ETH (about $6.52 million at the time of transfer), accompanied by additional shifts of roughly 470 ETH and 200 ETH. These linked transactions are part of the near-$8 million ETH outflows identified by investigators over the latest tracking window.

Mercado Bitcoin hacker wallet tracked by Arkham.

While Arkham flagged the possibility that the stolen ETH could eventually route through a mixing protocol such as Tornado Cash, its update did not confirm any deposits into the protocol. Tracking large ETH flows and any interactions with mixing services remains a priority for on-chain sleuths because mixers can obscure the origin and destination of funds, complicating recovery and enforcement efforts.

Altcoin holdings: concentrated exposure and liquidation risk

Lookonchain, another blockchain monitoring group, found that the attacker retained a diversified portfolio of altcoins after the initial breach. Notable holdings include:

• 372.99 billion PEPE tokens (approx. $1.79 million)
• 12,820 AAVE (approx. $1.61 million)
• 769,950 PENDLE (approx. $1.35 million)
• 29,830 EVA (approx. $1.26 million)
• 1.98 million VIRTUAL (approx. $1.15 million)
• 147,840 UNI (approx. $1.04 million)
• 2.67 million ONDO (approx. $1.03 million)

These concentrated positions mean the markets for those tokens could face sudden selling pressure if the attacker begins liquidating holdings on decentralized exchanges (DEXs) or using centralized venues to convert to stablecoins. Lookonchain warned that price slippage and cascading liquidations could hurt those token markets if aggressive sell-offs occur.

Freezes and law enforcement coordination — over $9M restricted

Industry responders moved quickly. Chainalysis reported that its investigators coordinated with Mercado Bitcoin within 30 minutes of identifying suspicious addresses and engaged law enforcement while notifying major token issuers and custodial providers. That joint action led to more than $9 million in funds being frozen, primarily through compliance actions taken by stablecoin issuers.

Tether took the lead among issuers, freezing over $9 million in USDT tied to wallets identified in the investigation. Initial containment efforts had already secured about $4 million in stablecoins before additional restrictions were applied across the following hours. Chainalysis said Paxos, Circle, Ripple and Anchorage Digital were among the entities that helped identify and limit the attacker’s options.

Despite these freezes, a sizable portion of the stolen assets remains in attacker-controlled wallets dispersed across Ethereum, Bitcoin, Solana, Tron and other networks. Investigators continue to monitor token swaps and cross-chain bridges to identify further recoverable assets.

How the breach unfolded

According to blockchain tracing firms, the attacker exploited an internal Mercado Bitcoin system on November 2 and initiated transfers from exchange hot wallets. Initial movements included:

• Approximately 2,852 ETH (around $6.52 million)
• Roughly $2.99 million in USDT
• About $2.24 million in USDC
• Approximately 104.43 BTC (valued at about $8.16 million)

Arkham and Bitquery have produced slightly different aggregate estimates; Bitquery placed the total moved from exchange wallets at roughly $48.5 million across ten blockchains, compared with Arkham's $46 million figure. Bitquery also flagged additional Ethereum deposit activity after Mercado Bitcoin announced it had contained the incident, suggesting attackers continued to move funds between wallets.

Mercado Bitcoin responded by pausing deposits and withdrawals while its security team worked with authorities and third-party forensics. The exchange maintains that customers’ personal data was not compromised and that the incident was contained.

Mixer risk and regulatory context: could Tornado Cash be involved?

Tornado Cash is a privacy-focused protocol that breaks on-chain links between sender and receiver addresses by pooling and mixing deposits. Because of that obfuscation, Tornado Cash has become a key red flag for investigators trying to trace stolen crypto.

Arkham’s mention of Tornado Cash reflects typical concerns when large ETH transfers move into multiple new addresses: mixers are a common next step for threat actors attempting to hide proceeds. However, in this case, Arkham did not find confirmed deposits into Tornado Cash in its most recent update. That said, attackers can use intermediate hops, cross-chain bridges, privacy-centric chains, or OTC brokers to launder funds — meaning the risk is ongoing until investigators can trace or freeze additional endpoints.

From a regulatory perspective, many jurisdictions treat mixing services as high-risk for money laundering, and some privacy tools have faced sanctions or legal scrutiny. That environment makes it harder for attackers to move large amounts directly through sanctioned or well-monitored mixers without triggering compliance responses from centralized token issuers and on- and off-ramps.

On-chain activity to watch

Investigators and exchanges will be tracking several key signals in the coming days:

• Any deposits into known mixer contracts (Tornado Cash or alternatives)
• Large swaps of altcoins into stablecoins or BTC across DEX liquidity pools
• Transfers to centralized exchanges, which may trigger freezing actions by custodians
• Cross-chain bridge usage that could split funds into less-monitored chains

Arkham noted 287 token swap events tied to the attacker’s addresses so far, including sales of smaller tokens like RENDER, WIF, KMNO and POPCAT. These patterns help analysts identify likely cashout strategies and liquidity points.

Wider market impact and precedent

This breach comes on the heels of another major incident: four days earlier, Binance reported a large-scale compromise that resulted in approximately $6.3 billion in stolen crypto. The Binance event triggered a large recovery and reimbursement effort, with the exchange using corporate treasury, SAFU reserves and insurance funds to replenish affected customers. By November 1, Binance said it had restored 95% of impacted assets and resumed withdrawals.

By contrast, smaller exchanges like Mercado Bitcoin often lack the same depth of corporate reserves, which makes rapid recovery less straightforward and elevates the importance of asset freezes, cooperative responses from stablecoin issuers, and law enforcement actions.

What investors and exchanges should do

For traders and exchanges, the immediate priorities are transparency and containment. Recommended actions include:

• Monitoring exchange hot wallets with real-time blockchain analytics
• Coordinating quickly with on-chain firms, stablecoin issuers and law enforcement
• Posting destination wallet addresses publicly to enable community tracking
• Implementing additional hot-to-cold segregation and withdrawal limits while investigations are ongoing

Until investigators can definitively follow the money into an identifiable cashout path or until custodians enforce freezes, the attacker retains access to millions in crypto. That uncertainty underscores the need for robust incident response plans, tighter internal controls, and stronger collaboration between exchanges, analytics providers and regulators.

Conclusion

The Mercado Bitcoin breach and the subsequent $8 million ETH transfers underscore how rapidly attackers move stolen crypto and how crucial fast coordination is to limit losses. While Arkham did not confirm any Tornado Cash deposits, the possibility remains a central worry for investigators because mixers complicate traceability. Ongoing asset freezes — led by Tether and facilitated by Chainalysis and others — have restricted more than $9 million so far, but a significant portion of the stolen portfolio remains active. The coming days will be key for tracking liquidity events, preventing large-scale sell-offs of altcoins, and identifying further recoverable funds across Ethereum, Bitcoin, Solana, Tron and beyond.