Mercado Bitcoin, Brazil's largest cryptocurrency exchange, lost approximately $49 million in a security breach that began in the early hours of 2 November. Chainalysis, a blockchain intelligence firm working with the exchange, coordinated a rapid response that resulted in nearly $10 million of the stolen assets being frozen.
The intervention focused on three areas:
- Tracing and labelling the stolen assets as they moved, then making that intelligence available through Chainalysis systems.
- Pinpointing which assets could be frozen or otherwise secured.
- Sharing actionable intelligence with law enforcement agencies and stablecoin issuers.
Breach across seventeen blockchains
The attacker drained funds held on seventeen different blockchains. Bitcoin and Ethereum accounted for the largest portions, but assets on Base, Tron and Polygon were also taken. The total loss is estimated at $49 million.
Coordinated freeze within hours
Mercado Bitcoin contacted Chainalysis at 2:30 am Eastern Time. A director at the exchange telephoned the firm's in-country specialist and provided a list of unauthorised transactions. Chainalysis investigators began mapping the flow immediately.
Within half an hour, the team had relayed freezable addresses to law enforcement. Chainalysis also contacted stablecoin issuers to flag opportunities to disrupt the theft. By morning, $4 million in stolen stablecoins had been locked down. Over the following hours, total freezes reached $9 million.
Analysts from three continents joined a digital coordination room to track fund movements and plan the response. The first hours after a hack offer the best chance to freeze centrally-issued stablecoins before attackers convert them into decentralised cryptocurrencies such as Bitcoin or Ethereum, which are harder to seize.
Chainalysis worked directly with Paxos, Anchorage Digital, Ripple, Circle and Tether during the response, coordinating with law enforcement to disable stolen stablecoins issued by those organisations.
In one example, investigators identified stolen USDT and traced it to addresses where the funds could be frozen. Using established channels with Tether and law enforcement, Chainalysis escalated the addresses and supporting evidence. Tether then froze more than $4 million in stolen funds.
A Chainalysis representative noted that the operation went beyond blockchain tracing. Investigators had to recognise intervention opportunities, identify which organisations had the authority to act, and coordinate the necessary response quickly.
Ongoing tracing and monitoring
Chainalysis continues to trace the remaining stolen funds, monitor their movement and identify further opportunities for intervention. Labelling addresses connected to the theft keeps the activity visible as assets move through the ecosystem. By sharing intelligence with partners who can act, Chainalysis aims to help the broader industry recognise and respond to stolen funds as they circulate.
Source: www.chainalysis.com