Mercado Bitcoin hacker swaps $10.5M in stolen altcoins for ETH
The attackers behind the $46 million Mercado Bitcoin hack have sold approximately $10.5 million worth of stolen altcoins for Ethereum, according to blockchain analytics firm Arkham.The sales took place over two days through multiple wallets, with the funds converted into 4,605 ETH through 338 swaps using MetaMask Router.Arkham said about $13 million in tokens and ETH left the labelled wallets through 115 transfers to 23 external addresses over the past day, including 22 newly created wallets. The largest tokens sold included $1.8 million in PEPE, $1.6 million in AAVE and $1.1 million in VIRTUAL. The wallets also received $818,000 in mUSD and $104,000 in USDC.One wallet directly linked to the Mercado Bitcoin hacker sold 39 Ethereum-based tokens, receiving 407 ETH worth approximately $925,000 and $174,000 in mUSD.The address subsequently transferred 300 ETH, worth around $688,000, to another wallet. Arkham also flagged a $650,000 attempted bridge to Bitcoin through Bridgers that appeared to have been halted.The attack itself hit on November 2, 2026. Attackers drained funds from Mercado Bitcoin’s hot wallets and from customer deposit addresses spread across more than 10 blockchains.The incident has been characterized as a signing-based attack. Broadly, that category covers cases where an attacker gains the ability to authorize transactions, effectively getting hold of the pen that signs the checks rather than breaking into the vault.Major fund movements were observed between 06:19 and 06:53 UTC. Outflows kept going for several hours after that window closed.Mercado Bitcoin’s preliminary figures put losses at around $38 million. Independent analyses suggested the total could be as high as $49 million, a gap that should narrow as the exchange completes its accounting.Stablecoin issuers moved quickly. Tether and Circle were among those that froze more than $11 million in stablecoins tied to the incident.That freeze helps explain the ETH pivot. Stolen USDT and USDC can be locked in place by their issuers with a few administrative actions. Ether offers no such off switch, which makes it the obvious destination for funds a thief wants to keep.Mercado Bitcoin has committed to refunding affected users. The exchange also stated that no customer data was compromised in the breach.