Mercado Bitcoin hacker moves $8 million in ETH as the exchange reports $11 million frozen

What moved on 3 November

Odaily published its flash at 14:28 SGT (06:28 UTC, 03:28 in Brasília): the attacker moved $8 million of ETH to a new wallet, "may be preparing" to deposit it into Tornado Cash, and holds $46 million in crypto assets. (Odaily)

PANews published the same figures at 14:26 SGT and named Arkham as the monitoring source. Both outlets describe the Tornado Cash route as a possibility. Neither report shows a completed mixer deposit, so this article treats it as a possible next step, not a finished one.

The $8 million is a dollar valuation at the time of the report. The opened reports give no ETH quantity, transaction hash or receiving address. Readers who want to follow the trail need Arkham's own labelled entity page, and an analytics label can be revised as more data arrives.

How the loss figures differ

Three different totals now circulate, and each comes from a different measurer.

The gap between the analysts' $46 million and the exchange's $38 million is $8 million. The opened reports do not explain it. Price moves between the two counts, different asset lists, or the treatment of frozen tokens could each produce a gap, but none of the sources says which one applies, so we leave it open.

The second $46 million figure, Arkham's holding estimate, sits awkwardly next to the freezes described below. The reports do not break it down by asset or say whether frozen tokens are included, so the share of it the attacker can actually move is unknown.

The freezes so far

The freeze total has grown each time a source updated it.

• By 16:42 UTC on 2 November (00:42 SGT on 3 November), Tether and Circle had frozen about $6.2 million of the stolen funds, according to Cointelegraph. The same report said about $20 million had moved to newly created wallets and more than $20 million, including all 106 BTC, remained in addresses Mercado Bitcoin had identified. (Cointelegraph)
• Odaily separately reported $5.55 million of assets frozen in addresses linked to the attacker. (Odaily)
• Lookonchain's later count, carried by Odaily and ChainCatcher, put the frozen amount at more than $9 million.
• Mercado Bitcoin then said on X that it had worked with Tether, Circle, Paxos, BRL1 and Chainalysis to freeze $11 million, that other freezable funds had been identified, and that handling was still in progress. PANews published that statement at 07:21 SGT on 3 November. (PANews)

On the exchange's own numbers, $11 million of $38 million is about 29%. That is our arithmetic on the exchange's two figures, not a recovery rate the company has published.

BRL1 appears in the list of partners. The exchange did not say how much each partner froze, so the $11 million cannot be split by issuer from the opened sources.

Synthetix moved 428,000 SNX out of the attacker's wallet

Separately, on-chain analyst Emmett Gallic reported that Synthetix governance moved 428,000 SNX, worth about $76,000, out of the attacker's wallet and into the Synthetix Protocol DAO address. PANews published the item at 08:48 SGT on 3 November. (PANews)

Odaily carried the same quantity and value. (Odaily)

The dollar amount is small next to the headline figures: $76,000 divided by 428,000 implies about $0.18 per SNX at the time of the report. The reports do not say whether the SNX will be returned to Mercado Bitcoin, or under what governance process, so treat this as recovered from the attacker but not yet returned.

What the attacker still holds in altcoins

Lookonchain listed seven altcoin positions still held by the attacker and warned they could face selling pressure. Odaily published the list at 09:36 SGT. (Odaily)

The seven values add up to $9.23 million: 1.79 + 1.61 + 1.35 + 1.26 + 1.15 + 1.04 + 1.03. ChainCatcher's version of the Lookonchain report gives "about $9.2 million" for the same basket, which matches. (ChainCatcher)

The freezes reported so far name stablecoin issuers and one governance action (Synthetix). None of the reports describes a freeze on any of these seven tokens, so for now they remain the part of the haul the attacker reportedly still controls.

How the attack worked, as security researchers describe it

Cointelegraph quoted CertiK senior security engineer Dickson Wu, whose early post-mortem said the attackers "picked at eight small chains for four hours", including Base, Optimism and Arbitrum, before moving to the company's main hot wallets. Wu also described tiny ETH transfers from 27,160 different addresses and wrote that "whoever did this can also move money out of MB's customer deposit addresses".

Security firms told Cointelegraph the theft used ordinary transfers rather than a smart-contract exploit. The incident has not been attributed to any group and remains under investigation.

Mercado Bitcoin told Cointelegraph that customers had suffered no losses and no data had leaked. In its later X statement, as reported by PANews, it repeated that users will not lose assets because of the incident and said it would announce the restoration time only through official channels.

Timeline in Singapore time

What this means for you if you hold a Mercado Bitcoin account

1. Do not resend a deposit while the pause is in place. If you sent crypto to your Mercado Bitcoin deposit address after the pause began, keep the transaction hash, network and timestamp. Wu's description of activity around customer deposit addresses is the reason to keep that record.
2. Use only official channels for the reopening. The exchange says the restoration time will come only through its official channels. A message offering early withdrawal, "compensation" or account verification through a link is the standard follow-up scam after any exchange incident.
3. Screenshot your balances now. A dated record of your account balance before reopening makes any later dispute easier.
4. Check deposit addresses before reuse. When deposits reopen, confirm whether the exchange has issued new deposit addresses before sending funds to an old one.

What to watch if you trade the affected tokens elsewhere

The altcoin basket is where the attacker's remaining choices could touch other markets. If you hold PEPE, AAVE, PENDLE, VIRTUAL, UNI or ONDO, a large transfer from the tracked wallet to an exchange deposit address is the signal worth watching. Lookonchain flagged possible selling pressure; none of the reports estimates a price effect, and this article does not either.

Traders with leveraged positions in those tokens can keep an eye on our liquidations tracker and the funding-rate board for sudden one-sided moves. Those pages show market data across venues; they do not track this wallet.

What we could not confirm

• The ETH quantity, transaction hashes and receiving address behind the $8 million move.
• Whether any of the ETH has entered Tornado Cash. Both reports call it a possibility.
• Why the exchange's $38 million figure is lower than the analysts' $46 million estimate.
• How much each partner froze within the $11 million, and whether the 428,000 SNX will return to the exchange.
• A date for deposits and withdrawals to resume.

Quick answers

Have Mercado Bitcoin customers lost money?

The company told Cointelegraph that customers suffered no losses, and repeated in its X statement that users will not lose assets because of the incident. That is the company's statement; no independent audit of customer balances has been published.

How much has been frozen?

Mercado Bitcoin says $11 million, frozen with Tether, Circle, Paxos, BRL1 and Chainalysis. Earlier tallies were $6.2 million (Cointelegraph, by 16:42 UTC on 2 November) and more than $9 million (Lookonchain).

Did the $8 million go into Tornado Cash?

The reports say the ETH moved to a new wallet and may be prepared for Tornado Cash. They do not show a completed deposit.

When will withdrawals reopen?

No date has been given. The exchange says it will announce the time only through official channels.