Blockchain analytics firm Chainalysis said it helped freeze nearly $10 million in stolen cryptocurrency following a security breach at Mercado Bitcoin, Brazil’s largest cryptocurrency exchange. The incident, which occurred in the early hours of November 2, reportedly resulted in approximately $49 million in stolen digital assets.
Chainalysis said it worked with Mercado Bitcoin, law enforcement agencies, and several cryptocurrency industry participants to trace the stolen funds and identify assets that could be frozen before they moved beyond recovery efforts.
The investigation resulted in the freezing of nearly $10 million in stolen funds, highlighting the role of blockchain analytics and industry coordination in responding to cryptocurrency thefts.
The attack involved assets distributed across 17 blockchain networks, with Bitcoin and Ethereum accounting for the largest portions of the stolen funds, according to Chainalysis.
Chainalysis Launches Immediate Investigation
Chainalysis said Mercado Bitcoin contacted its team shortly after discovering the security incident. At approximately 2:30 a.m. Eastern Time on November 2, a director at the Brazilian exchange notified a Chainalysis local solutions specialist about the breach.
The analytics company subsequently contacted law enforcement within approximately 30 minutes and began sharing information about potentially freezeable wallet addresses with stablecoin issuers and other industry partners.
Investigators from three continents joined a coordinated digital response operation to track the movement of the stolen cryptocurrency. Their work focused on identifying suspicious wallet addresses, tracing transactions across blockchain networks, labeling assets associated with the theft and locating opportunities to prevent further transfers.
The investigation required coordination across multiple blockchain ecosystems because the stolen assets were spread across 17 networks. Tracking funds across different networks can complicate recovery efforts, particularly when attackers attempt to move assets between platforms or convert them into other digital currencies.
Chainalysis said its investigators prioritized identifying assets that could be intercepted through cooperation with cryptocurrency companies and financial institutions.
Stablecoin Issuers Help Freeze Stolen Funds
By the morning of November 2, Chainalysis had helped secure approximately $4 million in stolen stablecoins, according to the company’s account.
Further investigation and coordination with law enforcement and industry partners resulted in additional freezes. The companies involved included Paxos, Anchorage Digital, Ripple, Circle and Tether.
Chainalysis reported that its collaboration with these organizations contributed to more than $9 million in frozen funds at Tether. The figure represented frozen stablecoins rather than the total value of Bitcoin and Ethereum stolen during the incident.
Read our blog on disrupting the Mercado Bitcoin attack for further details:
https://t.co/KD9Pw56SFw— Chainalysis (@chainalysis) November 3, 2026
Stablecoin issuers can play an important role in cryptocurrency investigations because certain centralized stablecoin arrangements provide mechanisms to restrict transactions or freeze tokens associated with identified illicit activity.
Such interventions can prevent stolen funds from being transferred or converted through other services, potentially creating opportunities for law enforcement agencies and affected platforms to pursue recovery.
However, freezing cryptocurrency does not automatically mean that the assets have been returned to their rightful owners.
Investigation Continues as Remaining Funds Are Traced
Chainalysis said it was continuing to monitor the stolen assets and investigate the movement of funds that had not been frozen.
The company also emphasized the importance of identifying and labeling wallet addresses connected to the attack. Blockchain transactions are publicly recorded on many networks, allowing investigators to follow the movement of digital assets even when funds pass through multiple addresses.
Marking suspicious addresses can help cryptocurrency exchanges, financial institutions, and other service providers identify potentially stolen assets when they encounter related transactions.
The investigation’s findings could therefore support additional intervention if the attackers attempt to move the remaining funds through identifiable cryptocurrency services.
Final Losses and Customer Recoveries Remain Unclear
Although Chainalysis reported freezing nearly $10 million, the final financial impact of the Mercado Bitcoin incident has not been independently established. Estimates reported on November 2 ranged from approximately $46 million to $49 million, depending on the source and calculation methodology.
The exchange and its partners had also not confirmed that the frozen funds had been returned to affected customers.
The incident demonstrates how cooperation between blockchain analytics firms, law enforcement agencies, exchanges and stablecoin issuers can help limit losses following large-scale cryptocurrency security breaches.
The continuing investigation will determine whether additional stolen assets can be identified and frozen as authorities and industry participants work to trace the remaining funds.
