Mercado Bitcoin Hacker Moves $8 Million in ETH as Frozen Total Passes $9 Million

Published November 3, 2026, 1:50 PM PKT. Based on blockchain analytics firm Arkham's November 3, 2026 post on the Mercado Bitcoin hacker wallets (primary source, as reported by crypto.news and KuCoin), tracker Lookonchain's November 3, 2026 holdings breakdown (primary source, as reported by crypto.news), blockchain analytics firm Chainalysis's November 2, 2026 report on the freeze effort (primary source, as reported by crypto.news), and crypto.news's November 3, 2026 report (secondary source). This is a follow-up to MABOnChain's November 2 article on the Mercado Bitcoin security incident, which covered the breach, the suspension of deposits and withdrawals, and the first freezes.

The hacker behind Mercado Bitcoin's November 2 breach moved about $8 million in Ethereum to new wallets on November 3, 2026, according to blockchain analytics firm Arkham, which raised the question of whether the funds could next reach Tornado Cash while confirming that no deposit into the mixing protocol had been identified. Arkham reported the transfers in a November 3 post, writing that the Mercado Bitcoin hacker had just moved $8 million of ETH to new wallets and asking whether he would deposit the ETH into Tornado Cash. The attacker still controls a cryptocurrency portfolio valued at roughly $46 million, according to Arkham's wallet data, and the new movement shows that portfolio is not sitting still while investigators chase it.

The $8 million ether move

According to Arkham's transaction records, as reported by crypto.news, the attacker has been distributing stolen Ethereum between several addresses associated with the breach. The latest activity includes a transfer of approximately 2,900 ETH, valued at $6.52 million, alongside smaller transactions involving 470 ETH and 200 ETH. Together those movements form the roughly $8 million in ETH transfers highlighted by the analytics firm. Arkham questioned whether the transferred ETH could eventually be sent to Tornado Cash, although its update identified no confirmed deposit into the protocol, and the transfers it showed involved wallets attributed to the attacker. Tornado Cash is a cryptocurrency mixing protocol that can make it harder to trace the relationship between sending and receiving addresses, which is why the destination of the transferred ETH is now an important part of the investigation. Arkham's on-chain investigation also identified 287 token swaps involving the attacker's wallets, including sales of smaller cryptocurrencies such as RENDER, WIF, KMNO and POPCAT, a sign the attacker has already been reshaping the stolen portfolio rather than simply holding it.

Frozen total passes $9 million

Efforts to restrict access to the stolen assets have resulted in nearly $10 million being frozen through coordination between blockchain investigators, law enforcement and cryptocurrency issuers, according to crypto.news. In a November 2 report, Chainalysis said its investigators worked directly with Mercado Bitcoin after the exchange reported the security incident, and that the company contacted law enforcement within 30 minutes of identifying addresses containing assets that could potentially be frozen. Chainalysis said its investigation involved coordination with Tether, Paxos, Circle, Ripple and Anchorage Digital to identify and restrict stolen assets where possible. According to the company, Tether subsequently froze more than $9 million in assets linked to the attack, following the identification of wallets containing stolen funds. The initial response had already secured approximately $4 million in stablecoins before further freezes were carried out over the following hours, which puts the growth in context: the frozen total roughly doubled from the $4.5 million in USDT that Tether chief executive Paolo Ardoino said the company froze on November 2. Despite those actions, a substantial portion of the stolen cryptocurrency remains under the attacker's control, with investigators continuing to monitor transfers and identify additional assets that may be recoverable.

The $46 million still in the attacker's hands

Blockchain tracking platform Lookonchain reported that the attacker continues to hold several altcoins worth more than $1 million each, and warned that those holdings could face selling pressure if the attacker decides to liquidate them. The largest is approximately 372.99 billion PEPE tokens valued at $1.79 million. Other holdings include 12,820 AAVE worth $1.61 million, 769,950 PENDLE worth $1.35 million, and 29,830 EVA valued at $1.26 million. The wallet contains roughly 1.98 million VIRTUAL tokens worth $1.15 million, 147,840 UNI worth $1.04 million, and 2.67 million ONDO valued at $1.03 million. Those figures matter beyond the hack itself: a forced sale of that size in thinner tokens can move prices, and traders watching PEPE, AAVE, PENDLE, VIRTUAL and ONDO now have a named seller to watch. The holdings sit alongside the attacker's larger balances in ether and bitcoin, which Arkham had valued at about $8.37 million in ETH and $8.24 million in BTC on November 2, before the latest ether transfers.

How the November 2 breach unfolded

The breach began on November 2 when an attacker gained unauthorized access to one of Mercado Bitcoin's systems and transferred cryptocurrency from wallets associated with the exchange, Brazil's largest cryptocurrency exchange. As crypto.news previously reported, Mercado Bitcoin temporarily halted cryptocurrency deposits and withdrawals while its security teams investigated the incident and coordinated with authorities. The exchange said it had contained the security incident and maintained that customers had suffered no harm or data breach, and it later published the destination addresses identified during the incident across Ethereum-compatible networks, Bitcoin, Solana, Stellar and Tron to help blockchain investigators monitor the stolen assets. Arkham's investigation showed that the attacker initially transferred 2,852 ETH worth approximately $6.52 million from an exchange hot wallet, followed shortly by $2.99 million in USDT and $2.24 million in USDC. Another transaction involved approximately 104.43 BTC valued at $8.16 million, while smaller transfers involved dozens of tokens held across other networks. A Bitquery investigation estimated that approximately $48.5 million had been transferred from exchange wallets across ten blockchains, compared with Arkham's initial estimate of at least $46 million. Deposits and withdrawals remained suspended, with no reopening timetable reported, and the incident came just four days after Binance suffered a separate security breach on October 29 that resulted in approximately $6.3 billion in stolen cryptocurrency. This article is news reporting and is not investment advice.

Sources

• Arkham, post on the Mercado Bitcoin hacker wallets (November 3, 2026, primary source, as reported by crypto.news and KuCoin: about $8 million in ETH moved to new wallets, about 2,900 ETH worth $6.52 million plus 470 ETH and 200 ETH, attacker holds about $46 million, Tornado Cash question with no confirmed deposit, 287 token swaps including RENDER, WIF, KMNO and POPCAT)
• Lookonchain, holdings breakdown for the Mercado Bitcoin hacker wallets (November 3, 2026, primary source, as reported by crypto.news: about 372.99 billion PEPE worth $1.79 million, 12,820 AAVE worth $1.61 million, 769,950 PENDLE worth $1.35 million, 29,830 EVA worth $1.26 million, about 1.98 million VIRTUAL worth $1.15 million, 147,840 UNI worth $1.04 million, 2.67 million ONDO worth $1.03 million, selling-pressure warning)
• Chainalysis, report on the Mercado Bitcoin freeze effort (November 2, 2026, primary source, as reported by crypto.news: direct work with Mercado Bitcoin, law enforcement contacted within 30 minutes, coordination with Tether, Paxos, Circle, Ripple and Anchorage Digital, Tether froze more than $9 million, about $4 million in stablecoins secured in the initial response)
• crypto.news, Mercado Bitcoin hacker moves $8M in ETH: Is Tornado Cash next? (November 3, 2026, secondary source: November 2 breach timeline, deposit and withdrawal suspension, exchange containment statement, initial transfers of 2,852 ETH, $2.99 million USDT, $2.24 million USDC and 104.43 BTC, Bitquery $48.5 million estimate)
• KuCoin, Mercado Bitcoin hacker transfers $8M in ETH, still holds $46M in crypto assets (November 3, 2026, 06:42 UTC, secondary source: Arkham monitoring, about $8 million in ETH to a new wallet, about $46 million still held)