An attacker who breached Mercado Bitcoin, one of Latin America's largest cryptocurrency exchanges, has converted stolen tokens into approximately $10.55 million worth of Ethereum, a move that signals an active effort to launder and obfuscate the trail of funds. According to blockchain intelligence firm Arkham Intelligence, at least $13.26 million has departed from wallets already labelled as belonging to the attacker — a figure that now outpaces Mercado Bitcoin's own revised estimate of blocked assets, which has climbed to $12.9 million.
The gap between what Arkham can trace moving out and what the exchange says it has managed to freeze tells a complicated story about the speed of modern crypto theft and the limits of real-time incident response. Exchanges can flag and attempt to block addresses, coordinate with counterparties, and alert centralized platforms to freeze funds — but a determined attacker with even a few hours of runway can convert tokens into more liquid, harder-to-trace assets before those measures take full effect.
ETH as the Laundering Rail of Choice
The decision to swap stolen tokens into Ethereum is not incidental. ETH remains the most liquid and widely accepted asset across decentralized finance (DeFi) protocols, centralized exchanges, and cross-chain bridges. Converting a diverse basket of tokens — which may include assets with limited liquidity or identifiable on-chain provenance — into ETH creates a more fungible pool that is easier to move, mix, and ultimately off-ramp through downstream services. The $10.55 million conversion represents a deliberate step in that laundering arc, reducing the attacker's surface area for asset seizure.
Arkham's ability to label and track these wallet clusters reflects how far on-chain forensics has matured. Rather than following individual transactions, modern intelligence platforms build probabilistic graphs of address ownership, flagging wallets that share behavioral fingerprints — timing patterns, fee structures, intermediate hops — with known attacker addresses. The $13.26 million figure Arkham has attributed to outflows from these labelled wallets is therefore not a single transaction but an aggregate across a web of addresses the firm has associated with the breach.
The Widening Gap Between Outflows and Frozen Assets
Mercado Bitcoin's revised blocked-assets estimate of $12.9 million suggests the exchange and its partners have managed to intercept a meaningful portion of the stolen funds. But the $13.26 million traced by Arkham as already exited from labelled wallets means a portion has moved beyond easy reach. Frozen assets are only as useful as the legal and technical infrastructure backing them — and in cross-jurisdictional crypto incidents, that infrastructure routinely lags behind the attacker's execution speed.
This dynamic is familiar to anyone who has tracked major exchange breaches. The critical window is the first several hours post-exploit, when attackers race to convert and disperse while exchanges scramble to identify the scope of the breach, alert ecosystem partners, and push wallet blacklists to centralized venues. Mercado Bitcoin raising its blocked-assets figure indicates ongoing coordination — but every hour without a comprehensive freeze is an hour the attacker can use to put more distance between stolen funds and their origin.
Latin America's Largest Exchanges Under Scrutiny
Mercado Bitcoin operates at significant scale within the Brazilian and broader Latin American retail crypto market, making this incident particularly consequential for regional investor confidence. A breach of this magnitude — with nine-figure dollar estimates across outflows and frozen assets — raises questions about custodial infrastructure, key management practices, and the speed of exchange-level incident response protocols. Brazilian regulators and the broader regional compliance community will likely be watching how the exchange handles disclosure, user reimbursement, and coordination with law enforcement.
For the wider industry, the incident reinforces an uncomfortable reality: even established, well-resourced exchanges remain targets, and the moment of compromise is rarely when the greatest damage is done. The real financial destruction happens in the hours and days following a breach, as attackers systematically liquidate and disperse holdings across protocols that ask few questions. The $10.55 million ETH conversion is not the end of this story — it is likely one node in a longer chain of hops that forensic teams will spend weeks unravelling.
What This Means
Arkham's public tracing of $13.26 million in attacker outflows against Mercado Bitcoin's $12.9 million blocked-assets figure draws a stark and instructive line: the attacker is marginally ahead, and the gap matters. Industry observers should watch whether centralized exchanges and DeFi protocols respond to wallet-flagging requests quickly enough to close that margin. Meanwhile, the $10.55 million already converted to ETH represents laundering infrastructure in motion — and a test of whether the ecosystem's collective compliance apparatus can respond faster than a motivated and technically capable adversary.
Written by the editorial team — independent journalism powered by Bitcoin News.