NodeWitness chart of the BTC accumulated at the Mercado Bitcoin attacker's address, rising to 106.07 BTC between blocks 974,216 and 974,224, and the BTC spent from it, flat at zero through block 974,431
Our chart, built from our node's data at block 974,431 (Nov 3, 2026).

Mercado Bitcoin Hacker Has Not Moved the 106 BTC Sitting at the Address the Exchange Published

NodeWitness Team 6 min read

The attacker who drained Mercado Bitcoin on November 2 took 106.07 BTC and has not spent a single coin of it. The stablecoins were largely frozen and the ether keeps hopping between wallets, yet the bitcoin sits exactly where the exchange said it would.

The bitcoin stolen from Brazilian exchange Mercado Bitcoin has not moved. The address the exchange named as the destination of the funds, 19qGpsHv, received 106.07 BTC across seven transactions and had no spent outputs when our node read it at block 974,431 on November 3 [2][8]. At that day's price, the coins are worth about $8.22 million [8].

That matters because bitcoin is the part of the loot nobody can freeze. Mercado Bitcoin, which Chainalysis calls Brazil's largest crypto exchange [5], disclosed the attack on November 2. "We quickly identified and contained a security incident in one of our systems," it said on X, before pausing deposits and withdrawals [1]. That night it put the assets involved at about $38 million, with $11 million blocked [3]. On November 3 it revised those figures to $36.3 million affected and $12.9 million blocked, and repeated that no customer would lose assets [4].

Analytics firms count more. Chainalysis estimates about $49 million taken across 17 blockchains and says it helped freeze nearly $10 million [5]. Bitquery tallies $48.6 million on the ten chains where the exchange lost money, with $11.4 million frozen by stablecoin issuers [7]. Onchain Lens, as reported by TokenPost, said the hacker held 3,680 ETH, 106 BTC and $8 million in stablecoins across 46 addresses [10].

One payment, 104.43 BTC

Nearly all of the bitcoin arrived at once. A single transaction in block 974,223 sent 104.43 BTC to the attacker [8]. Its 34 inputs came from two addresses, 102.03 BTC from bc1q6gd5 and 2.40 BTC from bc1qqxu9 [8]. Arkham describes that payment as the attacker sweeping Mercado Bitcoin's bitcoin hot wallet [6].

The wallet was no stranger to large sums. Active since block 958,912 in July 2026, bc1q6gd5 shows 7,594 transactions and 36,465 BTC received. That payment left it empty, and it has recorded no activity since [8]. The second address, bc1qqxu9, regularly received a little over 2 BTC at a time and forwarded it to the same hot wallet, the usual behavior of a deposit address [8].

The rest was small change. Three blocks earlier, another transaction pooled 86 inputs from 54 different addresses and sent 1.27 BTC to the attacker [8]. Bitquery counts 53 customer deposit addresses emptied on the bitcoin network [7]. Block 974,216 then delivered 0.37 BTC from an intermediate address, 1FGkTXZN, which had collected coins from ten older legacy-format addresses between blocks 974,198 and 974,200 [8]. That lines up with Bitquery's account of a few old exchange addresses being emptied late on Sunday night, Brazil time [7].

106.07 BTC received in seven transactions, 0 BTC spent, as of block 974,431 [8].

The fees tell their own story. The 104.43 BTC payment paid 2,875 satoshis, a little over 1 sat/vB, while the sweep of the 54 addresses paid 335,100 satoshis, about 50 sat/vB [8]. Bitquery noted that the big payment looks like the exchange's normal payouts, while the deposit sweeps used different software and paid far higher fees [7]. In its view, that fits access to the exchange's payout system plus the deposit keys, though the chain alone cannot prove it [7].

Nothing to freeze

Almost every freeze in this case has hit stablecoins, led by Tether, Circle and Paxos [3][7]. Chainalysis says the first hours are the window to stop centrally issued assets before an attacker converts them into harder-to-disrupt coins such as BTC and ETH [5]. The $8.22 million in bitcoin equals roughly 23% of the $36.3 million the exchange lists as affected, although the two figures use prices from different moments [4][8].

On Ethereum, the attacker has been busy. Bitquery describes the hacker spreading funds across ten new wallets, then gathering 3,649 ETH in two fresh ones [7]. When we read Ethereum block 26,336,501, those two wallets held 2,979 ETH and 670 ETH and had never sent a transaction [9]. The address Bitquery links to the hacker's payouts from the swap service Bridgers had grown to 760.8 ETH, up from the 211 ETH that firm counted on the morning of November 3 [7][9].

Binance, on a smaller scale

The pattern echoes the October 29 Binance hack, which Arkham puts at $6.36 billion [6]. There, the attacker took 18,270.2 BTC, split across 19 outputs that our node still showed unspent at the same block 974,431 [8]. We covered where that money sits in our piece on the Binance recovery gap. That is about 172 times more bitcoin than in the Mercado Bitcoin theft, with the same on-chain result. Not a single stolen coin has moved [8].

Where the two cases part ways is the rest of the loot. The Binance attacker waited three days before routing some of its SOL into bitcoin through Relay, as we reported in our piece on those swaps. Mercado Bitcoin's attacker was already swapping SOL and TRX into ETH through Mayan and Bridgers within the first two days, according to Bitquery [7], and still has not touched its bitcoin.

How long the 106.07 BTC stays put is the open question. Mercado Bitcoin says it is working with protocols and exchanges worldwide to identify and freeze funds tied to the attack [4]. If the coins leave 19qGpsHv, the first hop will be visible to anyone watching the chain.

We track how incidents like this feed into exchange flows in our market section.

Sources

Source type in brackets. Times in UTC. Accessed November 3, 2026.

  1. Mercado Bitcoin, official statement on X, 12:56 UTC, November 2, 2026. Incident contained, deposits and withdrawals suspended. Original in Portuguese, our translation. (Primary, company)
  2. Mercado Bitcoin, update on X listing the destination addresses, 14:24 UTC, November 2, 2026. Includes the bitcoin address 19qGpsHvzh1t6pVi526XNNkh6hW6prDZp. (Primary, company)
  3. Mercado Bitcoin, update on X and its continuation, 23:17 UTC, November 2, 2026. About $38 million involved and $11 million blocked with Tether, Circle, Paxos, BRL1 and Chainalysis. (Primary, company)
  4. Mercado Bitcoin, update on X and thread on tracing, 15:17 and 16:01 UTC, November 3, 2026. $36.3 million affected and $12.9 million blocked. (Primary, company)
  5. Chainalysis, Disrupting the Mercado Bitcoin Attack: How Chainalysis Led the Freeze of Nearly $10M in Stolen Funds, November 2, 2026. (Secondary, analytics)
  6. Arkham, Mercado Bitcoin Hack: Trace the $46M Stolen On-Chain, accessed November 3, 2026. (Secondary, analytics)
  7. Bitquery, Mercado Bitcoin Hack: $48.6M Taken on 10 Blockchains, figures verified November 3, 2026, Ethereum read at block 26,333,183. (Secondary, analytics)
  8. Our own reading with our bitcoin node (history and balance of the attacker's address, plus the status of its seven outputs and of the 19 outputs from the Binance theft) at block 974,431, around 19:50 UTC on November 3, 2026, cross-checked against the public mempool.space API for the source addresses. Price of $77,516 from mempool.space. (Primary, chain)
  9. Our own Ethereum reading through a public RPC node (ethereum-rpc.publicnode.com) of 0xe485…2478, 0x59a9…731e, 0x071f…9270 and 0x4d5f…2c9d, block 26,336,501, November 3, 2026. (Primary, chain)
  10. TokenPost, Onchain Lens Says Mercado Bitcoin Hacker Holds $46.5 Million, November 2, 2026. (Secondary, press)

More in Price and market

See all 23 articles in Price and market →

Last updated: November 3, 2026