Brazilian Exchange Attack: Hacker Shuffles $8M in ETH While Holding Billions in PEPE, AAVE

TLDR

• About $8 million in Ethereum was transferred to fresh addresses by the Mercado Bitcoin attacker on November 3.
• Speculation arose about potential Tornado Cash deposits, though none have been verified so far.
• More than $1 million in various altcoins—including PEPE, AAVE, and ONDO—remains in the hacker’s control.
• Over $9 million connected to the incident was frozen by Tether following coordination with Chainalysis.
• This attack occurred just four days following a massive $6.3 billion security incident at Binance.

---

The individual responsible for the $46 million security breach at Mercado Bitcoin has transferred approximately $8 million in Ethereum to newly created wallet addresses. On-chain intelligence firm Arkham documented these movements on November 3.

These fund transfers occurred just 24 hours after the assault on Brazil’s premier cryptocurrency trading platform. The security compromise impacted digital wallets spanning no fewer than ten different blockchain networks, prompting the exchange to temporarily halt both deposit and withdrawal operations.

Based on Arkham’s tracking data, the perpetrator has been distributing stolen Ethereum holdings across multiple addresses associated with the breach. The most substantial single transfer consisted of approximately 2,900 ETH, representing a value of $6.52 million.

[[SCRIPT_0]]

Additional transactions totaling 470 ETH and 200 ETH were also documented. Combined, these operations account for the roughly $8 million in Ethereum movements identified by the analytics platform.

Arkham posed the question of whether these funds might eventually flow into Tornado Cash. The privacy-focused protocol obscures transaction trails between sender and recipient addresses, making fund tracking significantly more challenging.

Up to this point, the transfers documented in Arkham’s latest report have only involved addresses connected to the attacker. No confirmed deposits into Tornado Cash have been detected.

Attacker Retains Significant Altcoin Positions

On-chain monitoring service Lookonchain revealed that the perpetrator continues to hold multiple altcoin positions each exceeding $1 million in value. Among these are approximately 372.99 billion PEPE tokens representing $1.79 million.

[[SCRIPT_1]]

Other significant holdings encompass 12,820 AAVE tokens valued at $1.61 million and 769,950 PENDLE worth $1.35 million. The wallet also contains 29,830 EVA tokens with a value of $1.26 million.

Additionally, the attacker possesses roughly 1.98 million VIRTUAL tokens worth $1.15 million and 147,840 UNI valued at $1.04 million. Another holding of 2.67 million ONDO tokens carries a valuation of $1.03 million.

Lookonchain issued a warning that these altcoin markets could experience downward pressure should the attacker liquidate these positions. Arkham’s tracking systems have already recorded 287 token exchange transactions originating from the attacker’s wallets, including disposals of RENDER, WIF, KMNO, and POPCAT.

Crypto Issuers Secure Over $9 Million in Stolen Assets

A collaborative effort between investigators, law enforcement agencies, and cryptocurrency issuers has successfully immobilized a portion of the stolen digital assets. In a November 2 statement, blockchain analysis firm Chainalysis detailed how its specialists engaged directly with Mercado Bitcoin immediately following the exchange’s incident notification.

Chainalysis made contact with law enforcement authorities within half an hour of identifying addresses containing assets subject to potential freezing. The organization reported coordination efforts with Tether, Paxos, Circle, Ripple, and Anchorage Digital.

Approximately $4 million in stablecoin assets were secured during the initial response phase. Subsequently, Tether immobilized more than $9 million in assets connected to the security breach.

The incident commenced on November 2 when an unauthorized party obtained access to one of Mercado Bitcoin’s internal systems. The platform stated it had successfully contained the situation and confirmed that customer funds and personal information remained uncompromised.

According to Arkham’s intelligence, the attacker’s initial action involved moving 2,852 ETH—approximately $6.52 million in value—from an exchange hot wallet. This was succeeded by transfers of $2.99 million in USDT, $2.24 million in USDC, and roughly 104.43 BTC worth $8.16 million.

An independent analysis conducted by Bitquery calculated that approximately $48.5 million departed from exchange wallets distributed across ten distinct blockchain networks. Bitquery’s investigation also uncovered additional Ethereum transactions occurring after the exchange announced containment of the incident.

Mercado Bitcoin subsequently released a comprehensive list of destination addresses across Ethereum-compatible networks, Bitcoin, Solana, Stellar, and Tron. This disclosure aims to assist investigators in tracing the movement of stolen digital assets.

This security breach transpired merely four days after Binance experienced a separate incident on October 29 that led to approximately $6.3 billion in stolen cryptocurrency. By November 1, Binance announced it had replenished 95% of impacted assets and restored Bitcoin withdrawal functionality.

As of November 3, data from Arkham indicates the attacker maintains control over a cryptocurrency portfolio valued at approximately $46 million. Investigation teams continue actively monitoring asset transfers while searching for additional funds that might be recoverable.