Tether Freezes $4.5 Million Tied to Mercado Bitcoin Hack as $46 Million Trail Emerges
•
November 2, 2026 8:00 pm
•
Comments
The security incident at Mercado Bitcoin has moved into a new phase: stablecoins are being frozen and the suspected attacker’s remaining wallets are now being mapped in public.
Tether CEO Paolo Ardoino said the company froze more than 4.5 million USDT tied to the incident. That closes off one part of the attacker’s escape route while investigators follow funds across chains.
Tether froze more than 4.5M USDT related to this security incident. https://t.co/PCtP4957jn
— Paolo Ardoino 🤖 (@paoloardoino) November 2, 2026
CryptoSlate reports that blockchain analytics firm Arkham identified roughly $46 million in cryptocurrency still held in wallets attributed to the attacker. The reported mix included about $8.37 million in Ether, $8.24 million in Bitcoin and $1.76 million in PEPE.
The attacker appears to be holding value across assets with very different control structures. Tether can freeze USDT at the token-contract level.
Bitcoin and Ether do not offer an equivalent issuer switch. Exchanges, bridges and other off-ramps become the practical pressure points.
That distinction matters because the reported $46 million is not one pool that a single company can lock. The USDT portion can be immobilized by Tether, while the Bitcoin, Ether and PEPE balances remain visible on-chain and can be followed as they move.
Investigators can flag those addresses, but stopping the rest depends on where the funds go next and whether a centralized service is willing and able to intervene.
The Mercado Bitcoin Hacker holds $46M of crypto.
This includes $8.37M ETH, $8.24M BTC, and $1.76M PEPE.
Track him using this custom entity on Arkham: pic.twitter.com/DcBKwbmgrH
— Arkham (@arkham) November 2, 2026
Mercado Bitcoin said it detected and contained a security incident affecting one of its systems overnight. The Brazilian exchange temporarily stopped deposits and withdrawals while examining suspicious asset movements, but said customer funds were not lost.
The unanswered question is timing. The exchange had not provided a firm reopening schedule in the cited report, leaving users to watch for the next operational update while the on-chain investigation continues.
The frozen USDT cannot move. Returning it still requires a legal and operational process.
Unfrozen assets can continue moving through decentralized infrastructure unless a service provider recognizes and blocks the associated addresses.
For now, the visible wallet trail gives investigators and exchanges something concrete to monitor. It also gives Mercado Bitcoin customers a clearer picture of the response: the incident has been contained at the exchange, a portion of the stablecoin exposure has been immobilized, and the remaining funds are under active scrutiny.
Join the conversation!
We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.