Mercado Bitcoin hackers swap $11M in stolen altcoins for ETH

The people who drained Brazilian crypto exchange Mercado Bitcoin are cashing out their grab bag. Hop wallets linked to the breach sold $10.55 million in stolen tokens for ETH, turning a messy pile of altcoins into one of crypto’s most liquid assets.

The thieves also tried to move some of the loot into Bitcoin. That attempt, a bridge worth roughly $650,000, appears to have stalled.

From a junk drawer of tokens to one asset

The conversion spree ran from November 3 to 4. Over that stretch, the attacker swapped more than 136 different tokens into Ether.

Estimates of the total value converted range from approximately $10.55 million to $11.9 million. Either way, it is a large share of the stolen haul now sitting in a single asset rather than scattered across dozens.

Swapping into ETH serves a practical purpose. A hundred-plus small-cap tokens are hard to move without wrecking their prices or drawing attention. Ether trades deep enough to absorb large sums, and unlike centrally issued stablecoins, it has no company that can freeze it on request.

The Bitcoin leg went less smoothly. A bridge transfer worth around $650,000 to BTC appears halted, described as a failed attempt.

How the breach unfolded

The attack itself hit on November 2, 2026. Attackers drained funds from Mercado Bitcoin’s hot wallets and from customer deposit addresses spread across more than 10 blockchains.

The incident has been characterized as a signing-based attack. Broadly, that category covers cases where an attacker gains the ability to authorize transactions, effectively getting hold of the pen that signs the checks rather than breaking into the vault.

Major fund movements were observed between 06:19 and 06:53 UTC. Outflows kept going for several hours after that window closed.

Mercado Bitcoin’s preliminary figures put losses at around $38 million. Independent analyses suggested the total could be as high as $49 million, a gap that should narrow as the exchange completes its accounting.

Stablecoin issuers moved quickly. Tether and Circle were among those that froze more than $11 million in stablecoins tied to the incident.

That freeze helps explain the ETH pivot. Stolen USDT and USDC can be locked in place by their issuers with a few administrative actions. Ether offers no such off switch, which makes it the obvious destination for funds a thief wants to keep.

The exchange’s response

Mercado Bitcoin has committed to refunding affected users. The exchange also stated that no customer data was compromised in the breach.

What this means for exchanges, users and stablecoins

The most immediate question is how much of the stolen money can still be recovered. With more than $11 million in stablecoins frozen and a $650,000 Bitcoin bridge apparently stuck, some portion of the haul is effectively out of the attacker’s reach. The ETH that has already been swapped is a different matter.

What to watch next: Mercado Bitcoin’s final loss tally, the mechanics and timeline of its refund program, and whether the swapped ETH begins moving through new wallets. The difference between the $38 million and $49 million estimates will also matter, since it determines how big a hole the exchange has promised to fill.