---
title: "Mercado Bitcoin Hack Leaves $1.79M in PEPE in Linked Wallet | MemeBlock"
description: "A wallet linked to the Mercado Bitcoin breach held 372.99B PEPE worth $1.79M, alongside millions in other altcoins, in a November 3 snapshot."
last_updated: "2026-11-02"
---

Latest News / MEMEBLOCK 
# Mercado Bitcoin Hack Leaves 372.99 Billion PEPE in Attacker-Linked Wallets
A wallet linked by blockchain investigators to the November 2 Mercado Bitcoin security incident held 372.99 billion PEPE

[A. Nav](/author/a-nav/) · $PEPE · Multiple blockchains November 4, 2026 18 min read 

Pepe (PEPE) meme coin beside a hacker's laptop displaying 372.99 billion PEPE tokens following the Mercado Bitcoin security breach. A visual representation of the Mercado Bitcoin security breach, with an attacker-linked wallet reportedly still holding 372.99 billion PEPE tokens after the $46 million incident. 

SHARE THIS STORY 

Key takeaways 
- Lookonchain's November 3 snapshot reported 372.99 billion PEPE worth approximately $1.79 million in wallets linked by investigators to the Mercado Bitcoin incident.

- The estimated breach value ranges from approximately $46 million to $49 million across different investigations while freeze totals vary by source asset coverage and reporting cutoff.

- The remaining PEPE balance could create selling pressure if liquidated but the snapshot does not prove a sale has occurred or establish a connection to the separate Binance exploit.

A wallet linked by blockchain investigators to the November 2, 2026, Mercado Bitcoin security incident held 372.99 billion PEPE tokens worth approximately $1.79 million, according to a [Lookonchain](https://lookonchain.com/feeds/80066) snapshot published on November 3. The same snapshot identified additional positions in AAVE, PENDLE, EVA, VIRTUAL, UNI and ONDO, putting several million dollars in other altcoins under potential selling pressure if the assets are liquidated.

The reported PEPE balance is a snapshot of an attacker-linked wallet, not evidence that the tokens have already been sold. Lookonchain listed approximately 12,820 AAVE worth $1.61 million, 769,950 PENDLE worth $1.35 million, 29,830 EVA worth $1.26 million, 1.98 million VIRTUAL worth $1.15 million, 147,840 UNI worth $1.04 million and 2.67 million ONDO worth $1.03 million. Together with PEPE, those seven positions represented approximately $9.23 million in estimated value at the time of the report.

The holdings emerged after Mercado Bitcoin, one of Brazil's largest cryptocurrency exchanges, confirmed that it had identified and contained a security incident affecting one of its systems. Blockchain investigations subsequently traced unauthorized asset movements across multiple networks. Initial public estimates placed the loss above $40 million, while later investigations produced figures closer to $49 million.

The different totals reflect evolving transaction coverage, wallet attribution and valuation methods. Mercado Bitcoin's own November 2 update said approximately $11 million had been blocked with the assistance of partners and that approximately $38 million remained unblocked. Chainalysis later described the incident as involving approximately $49 million in stolen funds, while Bitquery's detailed reconstruction counted approximately $48.5 million taken across ten blockchains.

The remaining PEPE position matters because the attacker-linked wallets have already been observed moving and swapping other assets. However, a token balance does not prove that a sale is imminent. The market risk depends on whether the wallet moves the tokens, where it sends them, how much liquidity is available and whether the assets can be frozen before liquidation.

## Mercado Bitcoin Hack Leaves 372.99 Billion PEPE in an Attacker-Linked Wallet
Lookonchain published its PEPE balance report on November 3, one day after Mercado Bitcoin disclosed the security incident. It identified 372.99 billion PEPE, with an estimated market value of approximately $1.79 million, among the assets still held by the wallet group it associated with the attack.

The quantity is substantial in token terms, but the dollar value provides a more useful measure of its potential market exposure. The $1.79 million estimate reflects the market price used by Lookonchain when it published the snapshot. It is not a guaranteed amount that could be realised if the entire position were sold.

The report also identified six other altcoin positions. The listed AAVE balance was approximately 12,820 tokens, valued at $1.61 million. PENDLE accounted for approximately 769,950 tokens worth $1.35 million. The wallet group also held approximately 29,830 EVA valued at $1.26 million, 1.98 million VIRTUAL worth $1.15 million, 147,840 UNI worth $1.04 million and 2.67 million ONDO worth $1.03 million.

The combined reported value of these seven token positions was approximately $9.23 million. This total is calculated from the rounded dollar estimates in Lookonchain's report and should be treated as an approximate snapshot, not a verified current portfolio valuation.

Arkham's Mercado Bitcoin Hacker entity page provides a separate way to monitor addresses and balances attributed to the incident. Its displayed balances can change as tokens move, prices fluctuate and new addresses are labelled. Arkham's current entity view should not be substituted for Lookonchain's November 3 snapshot without checking the exact observation time.

The distinction is important for PEPE holders. The November 3 report establishes that investigators were tracking a large PEPE balance in wallets attributed to the incident. It does not establish that every token remained in the same address after the snapshot, that the wallet operator still controlled all of the funds on November 4, or that a liquidation had begun.

## How Much Was Stolen From Mercado Bitcoin?
The initial loss estimates changed as investigators identified more wallets, transactions and networks.

On November 2, [Arkham](https://arkm.com/) reported that an attacker had drained at least $46 million from Mercado Bitcoin across at least ten blockchains. Its investigation described movements involving Ethereum, Bitcoin, Base, Tron, Polygon and other networks. The Block separately reported an approximately $46.3 million estimate based on Arkham data.

Chainalysis published its response on November 2 and estimated that approximately $49 million in assets had been stolen. Its investigation described movements across 17 blockchains, with the largest tranches coming from Bitcoin and Ethereum and additional assets taken from networks including Base, Tron and Polygon.

Bitquery's November 2 reconstruction counted approximately $48.5 million in transfers from Mercado Bitcoin wallets across ten blockchains, valued at the time of each transaction. Its investigation also described the later movement of assets from customer deposit addresses on Ethereum.

These estimates are not necessarily measurements of the same set of transactions. Arkham's initial report used its identified wallet labels and the assets it had traced at that point. Chainalysis described a broader response across 17 networks. Bitquery published a transaction-by-transaction reconstruction of transfers it attributed to Mercado Bitcoin across ten chains.

The valuation method also matters. Cryptocurrency prices change continuously. A transaction valued at one price when it occurs may produce a different dollar estimate when a researcher revisits the same transfer. Investigators can also add newly identified addresses or assets as the tracing work develops.

Mercado Bitcoin's own reported figure was lower. In its November 2, 21:00 update, the exchange said that approximately $11 million had been blocked and that the amount still unblocked was approximately $38 million. That statement implies a larger incident value when the blocked and unblocked figures are considered together, but the exchange did not publish a complete asset-by-asset forensic ledger in that update.

The figures should therefore be presented with their sources and measurement scopes. The incident is independently documented, but there is no single publicly audited total that reconciles every asset, transaction, freeze and valuation across all investigations.

## How Much of the Stolen Cryptocurrency Has Been Frozen?
Freezing assets has been a central part of the response because some cryptocurrencies, particularly centrally issued stablecoins, can be restricted by their issuers.

[Chainalysis](https://www.chainalysis.com/) said it mobilised investigators after Mercado Bitcoin alerted the company to the incident. It worked with law enforcement and industry partners to identify assets that could potentially be frozen. Chainalysis reported that it helped freeze nearly $10 million in stolen funds and said Tether froze more than $9 million after receiving addresses and supporting intelligence from investigators.

Tether's intervention was also reported by Arkham and The Block. Arkham's November 2 investigation said Tether had frozen approximately $4.5 million in USDT linked to the incident, citing Tether chief executive Paolo Ardoino. The Block reported that Tether had frozen more than $4.5 million in USDT at that stage.

These were early figures. They should not be treated as the final amount frozen by Tether throughout the response.

Mercado Bitcoin's November 2 evening update gave a broader figure. The exchange said it had blocked approximately $11 million with support from Tether, Circle, BRL1, Paxos and Chainalysis. It also said that approximately $38 million remained unblocked and that investigators had identified additional assets that might be eligible for intervention.

Bitquery's transaction-level report provided a narrower breakdown of assets it could verify in its own investigation. It counted approximately $7.3 million frozen by Tether and Paxos. Its report attributed approximately $5.9 million to Tether-related assets and approximately $1.5 million to Paxos-issued assets. Bitquery said Circle had not frozen any of the USDC and EURC it observed by the time of its last check, leaving approximately $4.29 million of those assets free to move.

A later Bitquery investigations index displayed a revised headline estimate of approximately $48.6 million taken and $11.4 million frozen. That is a later tracker-level summary, not a new figure that can automatically be assigned to one issuer.

The different freeze totals should not be added together. Chainalysis describes the result of its coordinated intervention, Mercado Bitcoin reports the total it says was blocked with its partners, and Bitquery reports the assets its analysts could identify and verify within their own address and transaction coverage. Their reporting cutoffs and classifications are not identical.

The role of each organisation also needs to be described accurately. Chainalysis provided blockchain intelligence and coordination. Tether, Circle and Paxos issue assets that may be subject to issuer-level restrictions. BRL1 was named by Mercado Bitcoin as a response partner. The public reports do not provide a complete, independently reconciled list of every asset frozen by every organisation at every point in time.

A freeze is also not the same as recovery. Restricting a token from moving can prevent further transfers, but it does not automatically return the asset to Mercado Bitcoin or its customers. Recovery and reimbursement are separate questions.

## What Mercado Bitcoin Said About Customer Losses and Data Exposure
Mercado Bitcoin's first public statement was published on November 2 at approximately 09:56 local time. The exchange said it had identified and quickly contained a security incident in one of its systems during the early morning.

The company made two direct assurances: customers had not suffered losses, and there had been no data leak. It said deposits and withdrawals were temporarily suspended as a preventive measure while its teams investigated, traced the assets and coordinated with the relevant authorities.

In its later November 2 update, Mercado Bitcoin explained that the incident affected hot wallets. Hot wallets are online wallets used for operational activity such as deposits and withdrawals. The exchange contrasted these with cold wallets, which are held offline and used for longer-term asset storage.

The company said the incident affected hot wallets and stated that the majority of its assets were stored in offline wallets. It also said that customer assets were guaranteed and that no customer would lose funds.

The exchange's November 2 evening statement listed Tether, Circle, BRL1, Paxos and Chainalysis among the partners assisting with asset blocking and recovery. It said approximately $11 million had been blocked and that around $38 million remained unblocked.

On November 3, Mercado Bitcoin reiterated that customer balances remained recorded in their respective accounts and that the exchange would cover the financial impact of the incident. CoinDesk reported that the company expected customers to suffer no losses and that it had not identified a customer data leak.

These statements are important, but their status should be clear. The customer-loss and data-exposure assurances are statements made by Mercado Bitcoin. Public blockchain transactions can show that assets moved from addresses associated with the exchange, but they cannot independently verify the exchange's complete customer ledger, internal accounting, reimbursement arrangements or the absence of unauthorised access to personal information.

Bitquery's investigation raised an additional operational concern. It reported that 35,853 Ethereum customer deposit addresses were emptied and that transfers from those addresses continued after the exchange's public statement that the incident had been contained. This finding does not itself prove that customers suffered financial losses, because Mercado Bitcoin says it will maintain customer balances and cover the incident. It does show why the exchange's response and the exact scope of the compromised signing access remain important.

Mercado Bitcoin has not publicly provided a complete technical explanation of how the attacker obtained the ability to move assets from the affected wallets and deposit addresses. The entry method and full scope of any internal system compromise remain unresolved in the reviewed public statements.

## Could the Remaining PEPE Holdings Put Selling Pressure on the Token?
The 372.99 billion PEPE balance identified by Lookonchain could become a source of selling pressure if the attacker-linked wallet converts the tokens into other assets or transfers them to venues where they can be sold.

The potential impact depends on how the position is liquidated. A large market sale can consume available buy-side liquidity and push the execution price lower, particularly if it is directed into a relatively shallow trading pool or executed rapidly across multiple venues.

A holder can also divide a large position into smaller transactions, route tokens through decentralized exchange pools or move assets between wallets before selling. Such activity can make the flow harder to interpret from one transaction alone. However, the existence of a large balance does not prove that the holder intends to use any particular strategy.

The estimated $1.79 million value is relevant because it provides a rough measure of the position's market exposure. It does not reveal the amount of liquidity available to absorb the tokens, the average execution price that could be achieved or the actual market impact of a future sale.

The other Lookonchain-listed positions also matter. AAVE, PENDLE, EVA, VIRTUAL, UNI and ONDO collectively represented approximately $7.44 million in estimated value in the November 3 snapshot. If those positions were liquidated alongside PEPE, the resulting activity could affect several separate token markets rather than PEPE alone.

But no such future liquidation should be assumed. The November 3 snapshot reported holdings, not completed sales. The tokens may be moved, frozen, sold, swapped, retained or transferred to additional addresses. Each possibility requires fresh transaction evidence.

For PEPE holders, the practical signal is therefore not simply the reported token balance. It is whether the attributed wallets begin sending PEPE to liquidity pools, centralised exchanges, bridges or other addresses associated with liquidation. Monitoring those flows is more informative than treating a static balance as proof of an active sell-off.

## Why the Mercado Bitcoin Incident Is Not Linked to the Binance Exploit
The Mercado Bitcoin breach occurred only days after a separate and much larger security incident involving Binance. The proximity of the two incidents has encouraged comparisons, but public reporting does not establish that they were connected.

The Binance incident was reported on October 29, 2026. Binance's public response described its own affected systems and remediation measures. The FBI attribution discussed in coverage of that incident concerned the Binance case.

Mercado Bitcoin confirmed a separate security incident on November 2. Its public statements did not attribute the breach to the Binance attacker or to the same group. Arkham's initial Mercado Bitcoin investigation also said no group had been linked to the incident.

CoinDesk's November 2 report explicitly noted that there was no public evidence connecting the Mercado Bitcoin incident to the Binance hack. The timing of two security incidents is not evidence of common ownership, coordination or responsibility.

The Mercado Bitcoin attacker remains unidentified in the reviewed public reporting. The wallet labels used by Arkham and other blockchain analytics services are investigative classifications, not proof of the real-world identity of the person controlling the addresses.

This distinction is particularly important when discussing the PEPE holdings. The tokens are associated with wallets attributed to the Mercado Bitcoin incident. That does not establish that the person or group responsible for the Binance exploit controls those funds.

## What Happens Next for PEPE and the Remaining Stolen Assets?
The next important development will be any movement from the addresses associated with the Mercado Bitcoin incident. A transfer of PEPE to a decentralized exchange pool, a centralised exchange deposit address or a new wallet could change the risk assessment.

The same applies to AAVE, PENDLE, VIRTUAL, UNI and ONDO. A fresh wallet snapshot could show that some positions have been sold, transferred or frozen. Until then, the November 3 Lookonchain figures should be treated as historical observations rather than a live inventory.

The recovery effort is also ongoing. Chainalysis said it would continue tracing the remaining funds and identifying opportunities for intervention. Mercado Bitcoin said it was coordinating with authorities and specialised partners. The public freeze estimates show that some assets were restricted, but they do not establish that the entire remaining loss has been recovered.

For customers, the exchange's promise to cover losses is a central part of the response. For token holders, the remaining PEPE position represents a possible source of additional supply if it is liquidated. For investigators, the priority remains tracing the movement of the stolen assets and identifying opportunities to restrict or recover them.

The available evidence supports a significant security incident, substantial asset movements across multiple blockchains and a November 3 snapshot showing 372.99 billion PEPE in attacker-linked wallets. It does not establish that the PEPE has already been sold, that the same balance remains unchanged today or that the Mercado Bitcoin incident is connected to the Binance exploit.

## Evidence Limitations
This report combines official exchange statements, blockchain analytics, address labels, transaction reconstructions and token-price estimates. These sources measure different parts of the incident and should not be treated as a single audited record.

### Confirmed Facts
Mercado Bitcoin publicly confirmed a security incident on November 2, 2026. Its first statement said the incident affected one of its systems, that deposits and withdrawals were temporarily suspended and that the company was investigating and coordinating with authorities.

Mercado Bitcoin stated that customers had not suffered losses and that no customer data had been exposed. Its later November 2 update said the incident affected hot wallets and that customer assets were guaranteed.

Chainalysis published an account of its response on November 2, stating that it had worked with Mercado Bitcoin, law enforcement and industry partners to identify stolen assets and support freezes.

Lookonchain published a November 3 snapshot reporting 372.99 billion PEPE worth approximately $1.79 million in wallets it associated with the incident.

### Source Attribution and Measurement Differences
Arkham initially estimated that at least $46 million had been drained across at least ten blockchains. The Block reported approximately $46.3 million using Arkham data.

Chainalysis estimated approximately $49 million in stolen assets across 17 blockchains.

Bitquery's detailed reconstruction counted approximately $48.5 million taken across ten blockchains. Its later investigations index displayed approximately $48.6 million taken and $11.4 million frozen.

Mercado Bitcoin's November 2 evening update said approximately $11 million had been blocked and approximately $38 million remained unblocked.

These figures use different address coverage, asset coverage, transaction cutoffs and valuation methods. They should not be combined into a single definitive loss figure.

### Lookonchain Holdings and Estimates
Lookonchain's November 3 snapshot listed approximately 372.99 billion PEPE worth $1.79 million, 12,820 AAVE worth $1.61 million, 769,950 PENDLE worth $1.35 million, 29,830 EVA worth $1.26 million, 1.98 million VIRTUAL worth $1.15 million, 147,840 UNI worth $1.04 million and 2.67 million ONDO worth $1.03 million.

These are approximate token quantities and dollar values reported at the time of the snapshot. They are not an independently audited inventory of every asset associated with the incident.

Arkham's entity page is dynamic. Its displayed balances can change as wallets move assets, prices change and address labels are updated. A later balance should not be assumed to match the November 3 Lookonchain snapshot.

### Frozen Funds: Different Reporting Cutoffs
Chainalysis reported that it helped freeze nearly $10 million and said Tether froze more than $9 million in stolen funds following the tracing and escalation process.

Mercado Bitcoin reported approximately $11 million blocked with support from Tether, Circle, BRL1, Paxos and Chainalysis in its November 2 evening update.

Bitquery's transaction-level report counted approximately $7.3 million frozen by Tether and Paxos in the assets it traced. It said Circle had not frozen the USDC and EURC it monitored by its last check.

These figures differ in scope and timing. The available sources do not provide a complete, independently reconciled issuer-by-issuer ledger of every frozen asset. A freeze also does not prove that the assets have been returned to the exchange.

### Unverified Claims and Estimates
The total loss remains an estimate based on the assets and addresses identified by investigators. The reviewed sources do not provide a public, independently audited accounting statement reconciling every affected blockchain, wallet, customer deposit address and token valuation.

The exact dollar value of the remaining PEPE and other altcoin positions can change with market prices. The Lookonchain values are estimates from its November 3 snapshot, not guaranteed liquidation proceeds.

The full technical method used by the attacker to obtain signing access has not been established in the reviewed public statements. The fact that transfers occurred from hot wallets and customer deposit addresses does not, by itself, establish the exact initial access vector.

### Unknown Information
The reviewed sources do not establish the real-world identity of the attacker.

They do not establish whether the attacker still controls every wallet included in the Lookonchain and Arkham labels.

They do not establish whether the 372.99 billion PEPE balance remained unchanged after Lookonchain's November 3 observation.

They do not establish whether all listed AAVE, PENDLE, EVA, VIRTUAL, UNI and ONDO positions remain available to the wallet operator or whether any additional assets have since moved.

The reviewed public material does not establish a complete technical account of the compromised system, the full scope of internal access or an independently verified forensic conclusion about customer data exposure.

The available freeze reports do not establish the final amount that will be recovered, returned or made permanently inaccessible to the attacker.

### On-Chain Observations Versus Wallet Identity and Intent
Public blockchains can show token transfers, wallet balances, transaction times and interactions with exchange or liquidity-pool contracts. Analytics providers can group addresses and assign labels based on observed flows, known wallet information and investigative methods.

Those labels are useful investigative evidence, but they are not proof of a person's real-world identity. They also do not establish that one person controlled every associated wallet or that a wallet's operator had a particular motive.

The 372.99 billion PEPE balance is a reported observation from Lookonchain's November 3 snapshot. It is not evidence that the holder intended to sell the tokens, that a sale was already underway or that all of the tokens could be liquidated at the displayed market value.

### Conclusions the Available Evidence Cannot Support
The reported $46 million, $48.5 million, $48.6 million and $49 million figures cannot be presented as identical measurements or as a single audited loss total. Each figure must retain its source and measurement context.

The reported $1.79 million PEPE position cannot be described as a completed sale or guaranteed future market supply. It is a reported wallet balance.

The reported freezes cannot be treated as fully recovered funds. Restricting a token from moving and returning it to the rightful owner are separate outcomes.

Mercado Bitcoin's statements that customers will not lose assets and that no data was exposed are official company assurances. They are not independently established by the public blockchain records cited in this report.

The incident cannot be attributed to the Binance exploit. No public evidence reviewed for this article establishes a direct connection between the two events.

### Editorial Conclusion
Lookonchain's November 3 snapshot reported 372.99 billion PEPE worth approximately $1.79 million in wallets linked by blockchain investigators to the Mercado Bitcoin security incident. The same snapshot identified additional AAVE, PENDLE, EVA, VIRTUAL, UNI and ONDO holdings worth several million dollars. Independent investigations place the total value of assets taken between approximately $46 million and $49 million, while freeze estimates vary according to source, coverage and reporting time. The remaining PEPE position represents potential selling pressure if liquidated, but the available evidence does not show that the tokens have already been sold or that the Mercado Bitcoin breach is connected to the Binance incident.

Sources & further reading 
- [https://www.bitquery.io/investigations/mercado-bitcoin-hack](https://www.bitquery.io/investigations/mercado-bitcoin-hack)

- [https://info.arkm.com/research/mercado-bitcoin-hack-trace-the-46m-stolen-on-chain](https://info.arkm.com/research/mercado-bitcoin-hack-trace-the-46m-stolen-on-chain)

## Sitemap

See the full [MemeBlock sitemap](/sitemap.md) for all pages.