Chainalysis puts Mercado Bitcoin loss at $49 million

A day after Mercado Bitcoin halted withdrawals, the shape of its loss is coming into focus. Chainalysis, the blockchain investigations firm the exchange itself called in, estimates about $49 million in assets was stolen in the November 2 attack, spread across 17 blockchains. That is higher than Hypernative's early estimate of more than $40 million, and higher than Arkham's $46 million valuation of wallets attributed to the attacker. The three figures cannot be added together, and none has been confirmed by the exchange as a final loss. Each was calculated differently.

An attack that moved in waves across 17 chains

According to Chainalysis, the attack began in the early hours of November 2 and moved in waves. The largest tranches taken came from Bitcoin and Ethereum, but the sweep also touched smaller networks such as Base, Tron, and Polygon. A Mercado Bitcoin director phoned Chainalysis's in-country specialist at 2:30 a.m. Eastern Time, and within 30 minutes Chainalysis had contacted law enforcement. By morning, $4 million in stablecoins was locked down. Further work brought the frozen total to nearly $10 million, mostly at Tether: more than $9 million in USDT was frozen after Chainalysis traced stolen funds to addresses where they could be frozen.

The exchange's own numbers: $38 million involved, $11 million blocked

Mercado Bitcoin itself gave a different set of numbers: about $38 million in "assets involved", and $11 million blocked through work with Tether, Circle, Paxos, BRL1, and Chainalysis. The exchange did not say whether the $38 million already includes the $11 million blocked, so the two cannot simply be added together. What it repeated: customers will not bear losses, and services stay suspended until full security conditions are met. There is still no reopening date.

One thing about freezes is often misread: frozen funds are not necessarily returned funds. Stablecoins frozen at an attacker's address cannot be moved out, but that does not mean they are back with the exchange or its customers. Chainalysis says tracing continues. Until there is an announcement of reopening or return, the status is unchanged from yesterday: withdrawals suspended, figures still estimates. The timeline of the incident and the three questions left open yesterday are in our first article. An attack through a different third-party route is in our Polymarket article.

Sources: Chainalysis blog (Nov 2, 2026), Mercado Bitcoin statement (reported by KuCoin, Nov 3, 2026), The Defiant (Nov 3, 2026). Figures are snapshots at writing time, morning November 3, 2026 WIB, and can change.

Written by Mastechon

Writing about crypto and Super Intelligence: market news, new projects, Super Intelligence models, and early opportunities like airdrops and testnets. Every piece starts from the official announcement, with the costs worked out up front.