Frozen within hours: $10 million of a $49 million theft

Mercado Bitcoin, Brazil's largest crypto exchange, lost an estimated $49 million in the early hours of 2 November, according to Chainalysis, which the exchange called in as a customer. The attacker moved assets out in waves across 17 blockchains. The largest tranches were in Bitcoin and Ethereum, but assets on smaller networks such as Base, Tron and Polygon were swept too. Nearly $10 million of it has since been frozen.

The account is useful mainly for its timeline. At 2:30 a.m. Eastern time a Mercado Bitcoin director phoned Chainalysis's in-country expert with a list of unauthorised transactions. Within 30 minutes investigators had passed freezable addresses to law enforcement and were talking to stablecoin issuers. By morning $4 million in stolen stablecoins had been locked down, and further freezes followed over the next hours. The largest single action came from Tether, which froze over $9 million in USDT after investigators traced the funds and escalated the addresses.

The logic is a race against conversion. Centrally issued stablecoins can be frozen by their issuers, so the first hours of a hack are spent finding those assets before the attacker swaps them into Bitcoin or Ether, which no issuer can stop. Chainalysis says it worked with Paxos, Anchorage Digital, Ripple, Circle and Tether during the incident, and that it is still tracing and labelling the remaining funds.

Two cautions apply. The figures are Chainalysis's estimates, published by a vendor about its own response for a customer, and other trackers have put the loss at slightly different amounts. And the frozen share, about a fifth, was possible only because part of the haul sat in stablecoins whose issuers can act; the Bitcoin and Ether that made up the largest tranches were not frozen.