Mercado Bitcoin Hack: What the $10M Freeze Means for Finance Teams
Nearly $10 million of the roughly $49 million stolen from Mercado Bitcoin, Brazil's largest crypto exchange, was frozen within hours of the breach. For finance teams, the practical lesson is that a single incident can produce a loss, a partial freeze and a possible recovery at the same time, and only well-structured records, ideally in dedicated crypto accounting software, let you describe each of those states accurately.
What happened at Mercado Bitcoin
According to the blockchain-intelligence firm Chainalysis, which published its account of the response, Mercado Bitcoin suffered a security incident in the early hours of November 2. An attacker began moving assets held across 17 blockchains, working in waves, to drain an estimated $49 million in various cryptocurrencies. The largest tranches came from Bitcoin and Ethereum. Assets on smaller networks, including Base, Tron and Polygon, were also swept.
Mercado Bitcoin was a Chainalysis customer and alerted the firm's team in the early hours of the incident. By the firm's own description, it mobilised investigators from three continents into what it called a digital war room. A Mercado Bitcoin director phoned the firm's in-country solutions expert at 2:30 am Eastern Time with the news, and shared a list of the unauthorized transactions. The investigator began mapping those movements straight away.
We are relying on a vendor's own account here, and it is written from the vendor's perspective. The figures below are the ones that account gives, and they should be treated as reported rather than independently verified.
The timeline as reported
The sequence matters because it shows how narrow the window for intervention is. Within 30 minutes, investigators had made contact with law enforcement to relay addresses that could potentially be frozen. Before long they were also talking to stablecoin issuers. By the morning, about $4 million in stolen stablecoins had been locked down, and over the following hours the total reached about $9 million, with the headline figure given as nearly $10 million.
| Item | Reported detail |
|---|---|
| Estimated amount stolen | Approximately $49 million |
| Blockchains affected | 17 |
| Largest tranches | Bitcoin and Ethereum |
| Smaller networks also swept | Base, Tron, Polygon |
| Frozen by morning | About $4 million in stablecoins |
| Total frozen over following hours | About $9 million, headline figure nearly $10 million |
| USDT frozen by Tether | Over $4 million |
Who acted on the freezes
The source says investigators communicated directly with Paxos, Anchorage Digital, Ripple, Circle and Tether, working with law enforcement to shut down stolen stablecoins those issuers had created. In one example, stolen USDT was traced to addresses where it could potentially be frozen. The addresses and supporting intelligence were escalated through existing relationships with Tether and law enforcement, and Tether froze over $4 million.
The source also says the work is continuing. Remaining funds are still being traced and monitored, and further opportunities for intervention are being identified. Labelling addresses tied to the theft keeps that activity visible as the funds keep moving.
Why the first hours decide what can be frozen
The source makes a point that is worth absorbing from an accounting perspective: the first few hours of a hack are the most important for investigators. In that window, centrally issued stablecoins can sometimes be frozen before the attacker converts them into harder-to-disrupt assets such as BTC and ETH. Once value is converted and moved, the options narrow sharply.
Freezable and non-freezable assets are different exposures
A freeze is not a recovery. Frozen stablecoins sit at an address under restriction. Whether and when they return to the victim depends on processes the source does not describe, so nothing here should be read as a guarantee of return. For a finance team holding balances at the affected venue, the stolen assets split into at least two categories with very different outlooks: assets that issuers were able to act on, and assets such as Bitcoin and Ethereum that the source describes as harder to disrupt.
That split should show up in your records. If your ledger only shows a single line for "exchange balance", you cannot separate the part with a plausible path to recovery from the part that is, for practical purposes, gone.
Speed is an operational control, not just a forensic one
The response described began with a phone call from the exchange to a vendor within hours. For firms that hold client or treasury assets at third-party venues, the equivalent question is internal: who in your organisation learns about an incident first, and how quickly can they produce a list of your exposures by chain and asset? Our earlier piece on spotting exposure to a hack with crypto accounting software covers that workflow in more detail.
Accounting implications for firms, auditors and CFOs
This is a news report about an investigation, not an accounting standard, so what follows is analysis rather than a statement of what any rule requires. Your actual treatment depends on your reporting framework, how you hold assets, whether you hold them directly or through a custodian, and what your contracts say. Confirm with your auditor and legal counsel.
Establish what you held at the venue, and when
The first task is a point-in-time position. You need your balances at the affected exchange at the moment of the incident, by asset and by blockchain, reconciled to your own wallet and venue records. The source says assets across 17 chains were drained, so a firm with multi-chain balances may find that its exposure is spread across networks it rarely reviews. Good crypto compliance and reporting records make this a query rather than a project.
If you only reconcile monthly, the incident date may fall between two reconciliations. Capture the last known position, the venue's statements, and any transaction history that the exchange makes available after the event.
Treat frozen, lost and recovered amounts as separate items
A practical way to keep records defensible is to avoid collapsing everything into one write-off decision on day one. Consider tracking, at minimum:
- Balances you believe were not affected, with the evidence for that belief.
- Balances that were stolen and appear to have been frozen by an issuer.
- Balances that were stolen and moved on, such as BTC or ETH.
- Any later recovery, with the date, amount and the party that returned it.
Whether an amount is recognised as an impairment, a loss, a receivable or a contingent item is a judgement for your framework and your auditor. The point for your bookkeeping is that the facts underpinning each judgement change over days, and your records should preserve that history instead of overwriting it.
Auditor expectations and evidence
Auditors will reasonably ask for evidence of existence and rights over digital assets held at third parties. After an incident, that evidence can be harder to obtain. Keep copies of the exchange's communications, any statements about the status of customer balances, and your own transaction records. Our note on accounting steps after a withdrawal halt at Mercado Bitcoin goes through what to document while access is restricted.
Tax and AML considerations
The source does not discuss tax treatment, and no tax authority guidance is cited in it, so we will not assert one. What we can say is where the questions will arise.
Tax: timing and characterisation questions
Whether a theft loss at a third-party exchange is deductible, when it is recognised, and how a later recovery is taxed all vary by jurisdiction and by the facts. A freeze that later results in a return could change the picture after you have already recorded a loss. Entities with Brazilian operations or counterparties should take local advice rather than assume treatment from another country. Document the incident date, the amounts by asset, and the valuation basis you use, so the position can be supported or revised.
Individual filers who held assets at the exchange face the same open questions at a smaller scale. They should keep their transaction history and any exchange notices, and seek advice before filing a loss position.
AML: stolen funds keep moving
The source stresses that the funds will keep moving and that labelling addresses tied to the theft keeps the activity visible. For regulated firms, that is a screening issue. If stolen assets reach your platform or your clients' wallets, the question of whether you can identify them depends on how current your address intelligence is. Firms that onboard or process deposits should check that their screening picks up newly labelled addresses, and that analysts know how to escalate a suspected hit.
It is also a reminder that stablecoin issuers can act on addresses when they are given actionable intelligence quickly. Compliance teams that deal with issuers should know the escalation route before they need it. For related context on how stolen funds are tracked at scale, see our coverage of blockchain-intelligence attribution of a major hack. Note that nothing in the Mercado Bitcoin source attributes this attack to any particular group, and we make no attribution.
What finance teams should do now
The following steps are a practical checklist, not a regulatory requirement. They come from the facts above: a multi-chain theft, a fast but partial freeze, and ongoing tracing.
For accounting firms and CFOs
- Pull a point-in-time position for any balances held at the affected exchange, by asset and chain.
- Separate balances into unaffected, frozen, and moved-on categories, and keep the evidence for each.
- Record the incident date and timeline from the exchange and from reliable public reporting, noting which figures are vendor-reported.
- Agree the recognition approach with your auditor early, and write down the assumptions.
- Set a review cadence so that later freezes, releases or recoveries update the records with a dated trail.
- Brief the board or client on what is known, what is unknown, and what you will do if funds are returned.
For compliance and operations teams
Confirm that address screening is refreshed frequently, that you can search historical deposits against newly labelled addresses, and that you have a named contact route for law enforcement and stablecoin issuers. Check your venue concentration: how much of your treasury sits on any single exchange, and on how many chains.
Where crypto accounting software fits
Dedicated crypto accounting software earns its place in an incident like this by answering fast, factual questions: what did we hold, on which chain, in which asset, at which timestamp, and how was it reconciled. Crypto bookkeeping software that keeps immutable transaction history and lets you tag positions by status makes the frozen, lost and recovered split straightforward. Digital asset accounting software that links wallet and venue data to the general ledger reduces the manual rebuild an incident would otherwise force. None of this prevents a theft, but it shortens the time between an incident and a defensible set of numbers.
FAQ
How much was stolen from Mercado Bitcoin and how much was frozen?
The source reports approximately $49 million stolen across 17 blockchains. About $9 million was frozen over the hours that followed, with the headline figure given as nearly $10 million. These numbers come from the account published by Chainalysis, so treat them as reported figures.
Does a freeze mean the funds will be returned?
No. The source describes funds being frozen, not returned. How and when frozen assets are released is not covered, so firms should not book a recovery until it actually occurs and is evidenced.
Which assets can be frozen after a hack?
The source says centrally issued stablecoins can sometimes be frozen before attackers convert them into assets like BTC and ETH, which are harder to disrupt. Issuers named as contacted include Paxos, Anchorage Digital, Ripple, Circle and Tether.
How should we record the loss while the facts are still changing?
Keep the categories separate: unaffected, frozen, moved-on, and later recovered, each with dated evidence. The recognition treatment itself depends on your reporting framework and auditor, so agree it with them rather than assuming.
What should an exchange-exposed firm check first?
Start with a point-in-time balance by asset and blockchain at the time of the incident, reconciled to your own records. Then collect the exchange's communications and confirm your screening picks up newly labelled addresses linked to the theft.
Source: Chainalysis