Hackers behind the breach of Mercado Bitcoin, a Brazilian cryptocurrency exchange and one of Latin America's largest crypto trading platforms, have begun cashing out their haul. Hop wallets linked to the attack have converted more than 136 different stolen tokens into Ether, consolidating a scattered pile of altcoins into one of crypto's most liquid assets, while a separate attempt to move roughly $650,000 into Bitcoin appears to have stalled. The conversions mark the most significant movement of the stolen funds since the November 2 breach.

From a Junk Drawer of Tokens to a Single Asset

The conversion spree ran from November 3 to November 4, 2026. Over that window, the attacker sold $10.55 million in stolen tokens for ETH, swapping more than 136 different tokens into Ether in the process. Estimates of the total value converted range from approximately $10.55 million to $11.9 million. Under either figure, a large share of the stolen funds now sits in a single asset rather than spread across dozens of smaller positions.

Hop itself is a cross-chain bridge — a service built to move tokens between blockchains — and in this case it served as the plumbing through which the scattered proceeds were funneled into a single liquid asset.

The pivot to ETH serves a practical purpose. More than a hundred small-cap tokens are difficult to sell without depressing their prices or attracting attention. Ether trades deep enough to absorb large sums, and unlike centrally issued stablecoins, it has no issuing company that can freeze it on request.

The Bitcoin leg of the operation went less smoothly. A bridge transfer worth around $650,000 into BTC appears halted and has been described as a failed attempt. Bridges are services that shuttle assets from one blockchain to another, and a transfer that stalls mid-route leaves funds sitting in transit rather than in the attacker's hands. That figure represents only a small fraction of the roughly $10.55 million to $11.9 million the attackers have already converted.

How the Breach Unfolded

The attack took place on November 2, 2026, when attackers drained funds from Mercado Bitcoin's hot wallets and from customer deposit addresses spread across more than 10 blockchains. Hot wallets, which remain connected to the internet to process deposits and withdrawals, are generally more exposed than cold storage, while deposit addresses are unique receiving addresses generated for individual users. A footprint spread across that many networks leaves the transaction trail scattered across separate public ledgers, each of which has to be examined on its own to reconstruct the full flow of funds.

The incident has been characterized as a signing-based attack. Broadly, that category covers cases in which an attacker gains the ability to authorize transactions — effectively obtaining the pen that signs the checks rather than breaking into the vault itself.

Major fund movements were observed between 06:19 and 06:53 UTC, and outflows continued for several hours after that window closed.

Mercado Bitcoin's preliminary figures put losses at around $38 million, while independent analyses suggested the total could reach as high as $49 million. The gap is expected to narrow as the exchange completes its accounting.

Stablecoin Issuers Move to Freeze Funds

Stablecoin issuers acted quickly. Tether and Circle were among those that froze more than $11 million in stablecoins tied to the incident. USDT and USDC, the tokens involved, are issued by Tether and Circle respectively.

That freeze helps explain the attackers' pivot to Ether. Stolen USDT and USDC can be locked in place by their issuers through a few administrative actions, whereas Ether offers no such off switch — making it an obvious destination for funds a thief wants to keep out of reach.

The Exchange's Response

Mercado Bitcoin has committed to refunding affected users. The exchange has also stated that no customer data was compromised in the breach. That point matters beyond privacy alone, since leaked customer records are routinely repurposed for targeted phishing campaigns against exchange users.

What to Watch

The most immediate question is how much of the stolen money can still be recovered. With more than $11 million in stablecoins frozen and a $650,000 Bitcoin bridge apparently stuck, some portion of the haul is effectively out of the attacker's reach. The Ether that has already been swapped is a different matter.

Key developments to watch include Mercado Bitcoin's final loss tally, the mechanics and timeline of its refund program, and whether the swapped ETH begins moving through new wallets. The difference between the $38 million and $49 million estimates will also matter, since it determines how large a hole the exchange has promised to fill.

Source: CryptoBriefing