Mercado Bitcoin hacker moves $8M in ETH as stolen funds remain under scrutiny

The attacker behind the Mercado Bitcoin breach has shifted roughly $8M worth of ETH to new wallets, with analysts watching for a possible move into Tornado Cash. For PSPs and exchanges, the useful detail is not the theater of the hack itself, but the follow-on laundering pattern: once assets hit a mixer, tracing gets a lot less comfortable.

1. Arkham said the hacker moved about 2,900 ETH worth $6.52M in the largest transfer, alongside smaller transfers of 470, 200 and 50 ETH. In a post on November 3, 2026, Arkham also said the hacker still held $46M of crypto and asked users to set alerts for new transfers.
2. Arkham analysts suggested the stolen ETH could be sent to Tornado Cash. If that happens, the normal sender-to-recipient trail becomes much harder to follow, which is the whole point of a crypto mixer and also why compliance teams treat it as a bright red flag.
3. Lookonchain said the hacker is still sitting on a large altcoin basket: 372.99 billion PEPE worth $1.79M, 12,820 AAVE worth $1.61M, 769,950 PENDLE worth $1.35M, 29,830 EVA worth $1.26M, 1.98 million VIRTUAL worth $1.15M, 147,840 UNI worth $1.04M, and 2.67 million ONDO worth $1.03M. Lookonchain added that selling these holdings could trigger strong selling pressure.
4. Arkham said the attacker’s addresses have been involved in 287 transactions, including sales of RENDER, WIF, KMNO and POPCAT. Arkham and Lookonchain also both indicated that more than $9M in stolen assets has already been frozen.
5. Mercado Bitcoin said the unauthorized access happened on November 2 and that it has suspended crypto deposits and withdrawals while its security team investigates and works with law enforcement. The incident came just days after the hack of Binance, where about $6.3B was reportedly stolen.