Chainalysis Puts the Mercado Bitcoin Hack at $49 Million Across 17 Chains — and Nearly $10 Million Is Already Frozen

The freeze tally is the new part of the story
Brazilian exchange Mercado Bitcoin was already in the headlines for a November 2 security incident that halted deposits and withdrawals. What is new is the response report: Chainalysis now puts the breach at about $49 million across 17 blockchains, with the largest tranches coming from Bitcoin and Ethereum, and says a coordinated response helped freeze nearly $10 million in stolen assets. The exchange's own figures differ in presentation but point the same way: about $38 million in "assets involved" and $11 million blocked through work with partners including Tether, Circle, Paxos, BRL1 and Chainalysis. The two sets of numbers are not a contradiction to add together — freeze tallies overlap, and a freeze is not a repayment — but together they mark the first time this incident has a credible, independently traced scale rather than an intraday estimate.

How the first hours unfolded
Chainalysis said a Mercado Bitcoin director called its local specialist at 2:30 a.m. ET and shared a list of unauthorised transactions, and that investigators contacted law enforcement within 30 minutes to relay addresses where assets could be frozen. The firm said it prioritised centrally issued stablecoins before attackers could swap them into harder-to-disrupt bitcoin or ether, attributing more than $9 million in freezes to Tether after tracing stolen $USDT, with earlier reporting putting Tether's own freeze figure above 4.5 million $USDT. By morning, Chainalysis said it had helped lock down $4 million in stolen stablecoins, with further freezes following through coordination with law enforcement and companies including Paxos, Anchorage Digital, Ripple, Circle and Tether. Onchain records show $USDT blacklist actions on Ethereum and Tron against destinations disclosed by Mercado Bitcoin, and a USDC blacklist on Polygon targeting its disclosed Ethereum-compatible address. The exchange reiterated that customers "will not suffer any loss of assets" because of the incident, while saying services remain temporarily suspended with no exact reopening timetable.
The second-wave warning every user should read
The Mercado response lands alongside a separate November 2 warning that matters more to ordinary users than any freeze tally. Binance warned customers about potential scams exploiting withdrawal delays as it recovers from its own $6.3 billion breach, saying fraudsters could impersonate Binance representatives and offer help with delayed transactions, compensation claims and asset recovery. The warning covers fraudulent emails, direct messages, group chats and even small cryptocurrency transfers carrying malicious instructions, and stresses that Binance does not charge fees to unlock withdrawals, offer paid recovery services, or ask customers to authorise wallet transactions to regain access. Scammers move within hours of any incident — fake "withdrawal reopened", "compensation" and "claim" links are the predictable second wave — and the defence is boring and absolute: use official links only, never share a seed phrase, and treat any message that asks you to approve a wallet permission to "recover" funds as the attack itself.
- Freeze, don't panic: a frozen stablecoin is blocked from moving, not returned — recovery still takes a legal and exchange process.
- Verify, don't click: go to the exchange's official site or app yourself; never follow a recovery link from a message.
- Permissions are the prize: approving a malicious wallet permission can let attackers move assets without further authorisation.
- Small transfers can be bait: tiny incoming transfers carrying instructions are a known lure — ignore them.

What this changes for exchange security
Two lessons stand out. First, the stablecoin freeze machinery — issuers blacklisting addresses within hours, coordinated through investigators and law enforcement — is now the fastest-working part of incident response, which is exactly why attackers rush to swap into bitcoin and ether. Second, the user-facing risk after a hack is often larger than the hack itself, because millions of worried customers are suddenly receptive to anyone promising help. That is why our standing safety guidance matters more in breach weeks than in quiet ones: check token approvals before you sign anything — https://zimbuck.com/blogs/801/How-to-Check-a-Token-Approval-Before-You-Sign-It — and remember the context of the emergency meetings this breach wave has already triggered: https://zimbuck.com/blogs/840/South-Korea-Calls-Emergency-Exchange-Security-Meeting-After-the-6 . Exchanges can freeze millions in hours; only users can refuse to hand over the keys in the first place.
FAQ
How much was taken from Mercado Bitcoin? Chainalysis puts it at about $49 million across 17 chains; Mercado Bitcoin cites about $38 million in assets involved and $11 million blocked — figures that overlap and use different methods, so they should not be added together.
Has any money been recovered? Nearly $10 million has been frozen, per Chainalysis — but a freeze blocks movement, it does not by itself return funds to the exchange.
Are Mercado Bitcoin customers going to lose money? The exchange says customers "will not suffer any loss of assets" from the incident; services remain suspended until full security conditions are met.
What should I do if I get a "recovery" message after a hack? Ignore it and go to the official site or app yourself. No legitimate exchange charges to unlock withdrawals or asks you to approve a transaction to recover funds.
Read more on Zimbuck: https://zimbuck.com/pages/zimbucknews and join the discussion at https://zimbuck.com/groups/zimbuckmarketnews . Related reading on the site: How to Check a Token Approval Before You Sign It, https://zimbuck.com/blogs/801/How-to-Check-a-Token-Approval-Before-You-Sign-It , and South Korea Calls Emergency Exchange Security Meeting, https://zimbuck.com/blogs/840/South-Korea-Calls-Emergency-Exchange-Security-Meeting-After-the-6 . Source for this story: Chainalysis response report via CryptoNews, https://cryptonews.net/news/security/33692623/ , and Binance second-wave scam warning, https://cryptopulsedaily.com/binance-warns-of-second-wave-of-crypto-theft-as-6-3-billion-hack-recovery-continues/ . This is market news and general information only, not financial advice. Join Zimbuck at https://zimbuck.com to follow more crypto security coverage.