Crypto /
Mercado Bitcoin Hackers Convert $11M in Stolen Crypto to ETH
Attackers who drained Brazilian exchange Mercado Bitcoin swapped over 136 altcoins into Ether between November 3 and 4, converting up to $11.9M USD (roughly $16.4M CAD) in stolen funds.
The hackers behind the Mercado Bitcoin breach are moving fast to clean up their haul. Between November 3 and 4, 2026, wallets linked to the attack on the Brazilian crypto exchange swapped more than 136 different tokens into Ether, converting somewhere between US$10.55 million and US$11.9 million (approximately CA$14.6 million to CA$16.5 million) in stolen altcoins into a single, highly liquid asset.
The original attack hit on November 2, 2026. Attackers drained Mercado Bitcoin's hot wallets and customer deposit addresses across more than 10 blockchains, with the bulk of outflows observed between 06:19 and 06:53 UTC, though funds kept moving for several hours after that window.
Why ETH, and Why It Matters
The pivot to Ether wasn't random. Holding over a hundred small-cap tokens is impractical for a thief: selling them in bulk tanks prices and flags suspicious activity. Ether, by contrast, trades at volumes large enough to absorb multi-million-dollar moves without much friction.
More importantly, ETH has no kill switch. Stablecoins like USDT and USDC can be frozen by their issuers, Tether and Circle respectively, with a few administrative actions. In this case, both companies acted quickly, freezing more than US$11 million (roughly CA$15.2 million) in stablecoins tied to the incident. That freeze pushed the attackers toward ETH, where no central authority can block a transaction.
A separate attempt to bridge approximately US$650,000 (about CA$900,000) worth of funds into Bitcoin appears to have stalled, described as a failed transfer.
What Kind of Attack Was This?
Security analysts have categorised the Mercado Bitcoin breach as a signing-based attack. That means the attackers didn't crack open the vault directly. Instead, they gained the ability to authorise transactions on behalf of the exchange, essentially getting hold of the credentials needed to move funds as if they were a legitimate party.
This category of attack is particularly damaging because it can bypass many conventional security layers. Once an attacker controls signing keys, they can initiate withdrawals that look technically valid, making early detection harder.
The Damage Estimate
Mercado Bitcoin's preliminary figures put total losses at around US$38 million (approximately CA$52.6 million). Independent on-chain analyses have suggested the figure could reach US$49 million (roughly CA$67.9 million). The gap between those two numbers should shrink as the exchange completes its full accounting.
The exchange has confirmed it will refund affected users and stated that no customer data was compromised in the breach.
Where Things Stand
Here's the current state of the stolen funds:
- Frozen: More than US$11 million (CA$15.2M) in stablecoins locked by Tether and Circle
- Converted: US$10.55 to US$11.9 million (CA$14.6M to CA$16.5M) in altcoins swapped to ETH
- Stalled: A US$650,000 (CA$900K) Bitcoin bridge transfer that appears stuck
The stablecoin freeze and the failed Bitcoin bridge give investigators some leverage, but the ETH that has already been converted is a much harder target. Once funds are in Ether and potentially moving through mixers or cross-chain bridges, recovery becomes significantly more difficult.
The Bigger Picture for Crypto Holders
For Canadians with funds on centralised exchanges, this breach is a reminder of a basic rule: hot wallets connected to the internet are attack surfaces. The signing-key vector used here isn't new, but the scale and speed of the conversion shows how quickly stolen crypto can be restructured to resist recovery.
Canada's crypto regulatory environment, overseen by the Canadian Securities Administrators and FINTRAC, requires registered crypto trading platforms to maintain specific cybersecurity standards. Even so, no regulation fully protects against a sophisticated signing-based attack if private key management is compromised at the source.
The question now is how much of the remaining ETH can be traced and potentially frozen through exchange cooperation before it disappears further into the chain.