Chainalysis Helps Freeze Nearly $10M After Mercado Bitcoin Hack

Mercado Bitcoin lost around $49 million in a hack on November 2, and Chainalysis says it helped freeze close to $10 million of the stolen funds after working with law enforcement and several crypto companies. For high-risk payment operators, the interesting part is not the headline number; it is how fast stolen assets can move across chains, and where freeze-and-block tools still work.

1. According to Chainalysis, the stolen funds were spread across 17 blockchains, with the largest transfers on Bitcoin and Ethereum. Transactions also appeared on Base, Tron, Polygon and other networks, which is a neat reminder that incident response is now a multi-chain exercise, not a one-ledger cleanup.
2. Mercado Bitcoin contacted Chainalysis soon after discovering the breach. At around 2:30 a.m. Eastern Time, one of the exchange’s directors called the firm’s local representative and shared a list of unauthorized transactions. Chainalysis then brought in team members from three continents to trace the funds and identify assets that might still be frozen.
3. Chainalysis contacted law enforcement within 30 minutes of that initial call and shared addresses where funds could potentially be frozen. It also contacted stablecoin issuers, because stablecoins are one of the few asset classes where issuers can block funds held at specific addresses before they move out of reach.
4. By morning, around $4 million in stablecoins had been blocked, and more funds were frozen as the response continued. Several companies took part in the effort, including Paxos, Anchorage Digital, Ripple, Circle and Tether.
5. Chainalysis says it traced stolen USDT to addresses that could be frozen and passed the findings to Tether and law enforcement. Tether then froze more than $9 million, according to Chainalysis. The company says monitoring is still ongoing, with the stolen assets being tracked, flagged and shared with other firms.

Nearly $10 million frozen is still only a slice of the reported $49 million loss. The rest may be harder to recover if it keeps moving between networks, which is exactly why speed, address intelligence and relationships with issuers matter when a hack crosses chains.