Tether freezes $4.5m of Mercado Bitcoin hacker's $46m haul
Tether has frozen more than $4.5 million in USDT tied to a security breach at Brazilian exchange Mercado Bitcoin, while wallets attributed to the attacker still hold roughly $46 million in crypto, according to blockchain analytics firm Arkham Intelligence.
Tether chief executive Paolo Ardoino confirmed the freeze on Nov. 2, saying the stablecoin issuer blocked more than 4.5 million USDT linked to the incident. Tether is also a major investor in the exchange, having announced a $20 million strategic investment in Mercado Bitcoin in July to support its expansion into tokenisation, payments and other digital financial services. On-chain analyst Specter reported that coordinated efforts involving security researchers and stablecoin issuers had widened the immobilized total to more than $9 million across nine digital assets, including USDC, PAXG and RLUSD.
Arkham's tally of the attacker's holdings includes $8.37 million in Ethereum, $8.24 million in Bitcoin and $1.76 million in PEPE. Mercado Bitcoin said it had identified and contained a security incident affecting one of its systems overnight, temporarily suspending deposits and withdrawals while it investigated suspicious asset movements. The exchange said customers suffered no financial losses and that no personal information was compromised, but it has not disclosed the financial extent of the attack or whether its corporate reserves were affected. It later published suspicious destination addresses across Bitcoin, Ethereum-compatible networks, Solana, Stellar and Tron to support tracing and potential recovery.
The breach lands less than four days after hackers stole a record $6.3 billion from Binance on Oct. 29, extending a run of major attacks on centralised exchanges. Binance's incident followed a $388 million breach at Bitget on Sept. 24, when attackers siphoned assets from the exchange's wallet infrastructure; Bitget tapped its protection fund to absorb the losses and protect customer balances.
The pattern echoes 2025, when Bybit lost about $1.5 billion after hackers manipulated the transaction approval process for one of its Ethereum cold wallets, following a $69 million hot-wallet breach at Phemex in January. The FBI has attributed the Bybit and Binance thefts to the North Korean-linked TraderTraitor operation, though investigators have not established any connection between those operations and the Mercado Bitcoin breach.
