Mercado Bitcoin hack: $49 million stolen, Chainalysis blocks $10 million

Mercado Bitcoin hit by hackers: 49 million in cryptocurrencies stolen

During the night between November 1st and 2nd, Mercado Bitcoin, the largest cryptocurrency exchange in Brazil, suffered a cyber attack that led to the theft of approximately 49 million dollars in digital funds. The Brazilian giant, a client of Chainalysis, immediately alerted the analysis team of the company specializing in blockchain intelligence, activating a coordinated response that allowed almost 10 million dollars of the stolen funds to be blocked.

Quick Response

An attack on multiple blockchains

The attack began in the early hours of November 2nd, with hackers transferring assets distributed across 17 different blockchains. The largest amounts were withdrawn from Bitcoin and Ethereum, but smaller networks like Base, Tron, and Polygon were also affected. Chainalysis analysts worked across three continents to track the flow of funds and coordinate the response.

Chainalysis's immediate response

The first hours after an attack are crucial for investigators, who must act quickly to block assets before hackers convert them into cryptocurrencies that are harder to trace, such as Bitcoin and Ethereum. The Chainalysis team started working from the very first moment, identifying which assets had been stolen and which could be blocked.

At 2:30 a.m. (Eastern Time), a director of Mercado Bitcoin contacted Chainalysis's local solutions expert to inform him of the attack. Within 30 minutes, investigators had already contacted law enforcement to report the blockable addresses. Subsequently, they contacted the stablecoin issuers to coordinate intervention actions.

Collaboration with stablecoin issuers and law enforcement

During the attack, Chainalysis collaborated directly with Paxos, Anchorage Digital, Ripple, Circle, and Tether, working with law enforcement to block the stolen stablecoins. For example, investigators identified stolen funds in USDT, tracking them to addresses where they could be blocked. Thanks to the established relationships with Tether and the authorities, they managed to block over 9 million dollars in stolen stablecoins.

The priorities of the response

The Chainalysis team focused on three immediate priorities: identifying, tracking, and labeling the stolen assets; identifying opportunities for intervention to block the assets; coordinating actions with external partners. This approach allowed the effectiveness of the response to be maximized and the damage minimized.

The next moves

Chainalysis's commitment does not stop at the initial blocks. Analysts continue to track the remaining funds, monitoring their movements and identifying further opportunities for intervention. Labeling addresses linked to the theft keeps suspicious activity visible, allowing the broader ecosystem to recognize and respond to the movements of stolen funds.

The collaboration between exchanges, blockchain service providers, and law enforcement remains fundamental to effectively countering these attacks. The Mercado Bitcoin episode underscores the importance of a coordinated approach and the sharing of intelligence to protect digital assets.

The importance of NIS2 compliance and cyber insurance

Incidents like this highlight the need for companies to adopt advanced protection measures, such as a managed SOC or an MDR service, to detect and respond promptly to threats. Furthermore, the NIS2 directive imposes stringent operational security requirements, making it essential for cryptocurrency exchanges to invest in cyber insurance and breach remediation to mitigate the financial risks associated with such attacks.

To learn more about how to protect digital critical infrastructures, explore our NIS2 compliance guide and discover advanced Managed Detection and Response solutions.

For further details on how exchanges can protect themselves from cyber attacks, also see our analysis on the best security practices for trading platforms.