Blockchain analytics firm Chainalysis said it helped freeze nearly $10 million in stolen cryptocurrency after a security breach at Mercado Bitcoin, Brazil's largest cryptocurrency exchange. The incident, which took place in the early hours of November 2, reportedly involved approximately $49 million in stolen digital assets.

According to the company, Chainalysis worked alongside Mercado Bitcoin, law enforcement agencies, and multiple cryptocurrency industry participants to trace the stolen funds and identify assets that could be frozen before they moved beyond the reach of recovery efforts. The operation resulted in the freezing of close to $10 million — roughly one-fifth of the reported stolen total — underscoring the role of blockchain analytics and cross-industry coordination in responding to cryptocurrency thefts.

Chainalysis said the stolen assets were distributed across 17 blockchain networks, with Bitcoin and Ethereum accounting for the largest portions of the missing funds.

Rapid Response After the Breach

Mercado Bitcoin contacted Chainalysis shortly after discovering the security incident, according to the company. At approximately 2:30 a.m. Eastern Time on November 2, a director at the Brazilian exchange notified a Chainalysis local solutions specialist about the breach.

The analytics firm then contacted law enforcement within roughly 30 minutes and began sharing information about potentially freezeable wallet addresses with stablecoin issuers and other industry partners. The quick turnaround reflects the nature of cryptocurrency theft response, in which assets can be moved between wallets or swapped for other tokens within minutes, narrowing the window in which stolen funds can still be intercepted.

Investigators from three continents took part in a coordinated digital response operation to track the movement of the stolen cryptocurrency. Their work focused on identifying suspicious wallet addresses, tracing transactions across blockchain networks, labeling assets tied to the theft, and locating opportunities to block further transfers.

The effort required coordination across multiple blockchain ecosystems because the stolen assets were spread across 17 networks. Tracking funds across different chains can complicate recovery, particularly when attackers move assets between platforms or convert them into other digital currencies. Chainalysis said its investigators prioritized identifying assets that could be intercepted through cooperation with cryptocurrency companies and financial institutions.

Stablecoin Issuers Move to Freeze Funds

By the morning of November 2, Chainalysis had helped secure approximately $4 million in stolen stablecoins, according to the company's account. Further investigation and coordination with law enforcement and industry partners led to additional freezes, involving Paxos, Anchorage Digital, Ripple, Circle, and Tether.

Chainalysis said its collaboration with those organizations contributed to more than $9 million in frozen funds at Tether. The figure represents frozen stablecoins rather than the total value of the Bitcoin and Ethereum stolen in the incident.

Read our blog on disrupting the Mercado Bitcoin attack for further details:
— Chainalysis (@chainalysis) November 3, 2026

Stablecoin issuers can play a significant role in cryptocurrency investigations because certain centralized stablecoin arrangements include mechanisms to restrict transactions or freeze tokens linked to identified illicit activity. Such interventions can prevent stolen funds from being transferred or converted through other services, potentially creating opportunities for law enforcement agencies and affected platforms to pursue recovery. Freezing cryptocurrency, however, does not automatically mean the assets have been returned to their rightful owners.

Investigation Continues on Remaining Funds

Chainalysis said it is continuing to monitor the stolen assets and investigate the movement of funds that have not yet been frozen. The company also emphasized the importance of identifying and labeling wallet addresses connected to the attack.

Blockchain transactions are publicly recorded on many networks, allowing investigators to follow the movement of digital assets even when funds pass through multiple addresses. Marking suspicious addresses can help cryptocurrency exchanges, financial institutions, and other service providers recognize potentially stolen assets when they encounter related transactions. The investigation's findings could therefore support further intervention if the attackers attempt to move the remaining funds through identifiable cryptocurrency services.

Final Losses and Customer Recoveries Remain Unclear

Although Chainalysis reported freezing nearly $10 million, the final financial impact of the Mercado Bitcoin incident has not been independently established. Estimates reported on November 2 ranged from approximately $46 million to $49 million, depending on the source and calculation methodology. The exchange and its partners had also not confirmed that the frozen funds had been returned to affected customers.

The incident illustrates how cooperation among blockchain analytics firms, law enforcement agencies, exchanges, and stablecoin issuers can help limit losses following large-scale cryptocurrency security breaches. The continuing investigation will determine whether additional stolen assets can be identified and frozen as authorities and industry participants work to trace the remaining funds.