Mercado Bitcoin: 3,652.5 ETH in onward transfers and a separate Bitcoin trail

On 2 November 2026, assets from a source wallet reached an Ethereum address that Mercado Bitcoin later identified in its incident disclosure. Hours later, that recipient began sending ETH to other addresses. This investigation follows the difference between those two stages: assets arriving at an incident-linked address, and the same address distributing value onward. It also checks the exchange-disclosed Bitcoin recipient separately.

The verified Ethereum route in this report is source wallet → disclosed recipient → selected subsequent recipients. The Bitcoin credits form a separate record. No service request or settlement record examined here joins the Ethereum path to Bitcoin. The report therefore does not draw an Ethereum-to-Bitcoin arrow.

Mercado Bitcoin is a cryptocurrency exchange. A hot wallet is an online wallet used in day-to-day operations; a deposit address is where a customer sends assets before the exchange accounts for or collects them. Those operational labels require evidence beyond a transfer. Here, “source wallet” identifies the sender in the reviewed records. Bitquery describes it as a Mercado Bitcoin hot wallet, but this article does not independently audit its ownership or the exchange’s signing systems.

The exchange’s address disclosure provides the incident connection for the recipient addresses. A disclosed address identifies a monitoring target; it does not identify a person. ETH is Ethereum’s native asset. USDT and USDC are separate dollar-linked tokens, each with its own issuer and contract. Token transfers and ETH transfers must be counted in their respective units.

1. A small payment preceded the main ETH transfer

What arrived first? The source listing records a 0.0001 ETH payment to the disclosed recipient at 06:24:23. Twenty-four seconds later, at 06:24:47, the same source sent 2,852.067435264900027051 ETH. The larger transaction succeeded in block 26325283. Its full value, sender and recipient were checked in the public explorer as well as the indexed listing.

The small-then-large order is observable. Calling the first payment a deliberate test would require evidence of intent that these transfers do not contain. Likewise, a successful signed payment establishes that the network accepted the transaction; it does not explain how the ability to authorize it was obtained.

2. The two stablecoin transfers are separate ledger entries

At 06:26:11, the source called the USDT and USDC contracts. Each transaction had a native ETH value of zero, yet each recorded a token transfer to the disclosed recipient. A token contract maintains its own balances; the transaction’s ETH-value field is not the amount of the token moved.

The USDT Transfer event records 2,990,643.178450 USDT. The USDC event records 2,236,100.704728 USDC. Both use six decimal places: the raw integer is divided by one million to obtain token units. The contract addresses, full hashes and log indices are preserved in Appendix A. These are selected incoming assets, not a complete inventory or an independently priced whole-incident loss.

The surrounding token history also contains zero-value entries and tokens using names that resemble familiar assets. This review identifies the canonical contracts rather than trusting a symbol such as “ETH” or “USDC.” A token named ETH is not native ether. Those entries are not included in the native-ETH totals below.

3. The recipient later distributed native ETH

The next question is where the disclosed Ethereum recipient sent value. Its native outbound listing contains eight positive-value transactions on 2 November in the reviewed window. The first selected payment sent 2,800 ETH at 12:07:35. A later payment of 130 ETH reached the same recipient, giving that address 2,930 ETH across the two records. Other payments reached six additional addresses.

Read Figure 1 from the exchange-disclosed recipient at the top. Each arrow represents native ETH leaving that address. The panels group payments by recipient, with three small recipients combined only for readability; Appendix B preserves every full address and hash. Line width and panel spacing do not represent quantity or elapsed time.

Figure 1. Selected Ethereum native-asset outflows, 2 November UTC. Recipient A receives two payments; the final panel groups three different addresses. Source: preserved Blockscout outbound listing. This is a partial-flow diagram, not a reconciliation of all incoming assets.

The eight payments total 3,652.5 ETH. This outgoing total and the single large source payment discussed earlier have different scopes. The later payments may draw on other inflows or a pre-existing balance; a complete funding reconciliation has not been established. This report has not allocated each later wei to a particular earlier source. Adding the outgoing 3,652.5 ETH to the incoming 2,852.067435264900027051 ETH would count movement at multiple stages as new loss. Neither figure is a current balance.

A payment to another address proves a transfer relationship. It does not prove common ownership, a sale, a custodial exchange deposit or a withdrawal to fiat money. The next investigative question is the exact onward transaction or service record for each branch, rather than the shape of the distribution alone.

4. Bitcoin: outputs are the unit of evidence

The Bitcoin review starts again with the separately disclosed Bitcoin address. A Bitcoin transaction can pay multiple outputs, including change back to the sender. The amount relevant to this recipient is its specific output, identified by a transaction ID and output index, rather than the transaction’s total input value.

The public address endpoint returned seven confirmed transactions with an output to the disclosed recipient. Those seven outputs total 10,606,780,001 satoshis, or 106.06780001 BTC. A satoshi is one hundred-millionth of a bitcoin. The largest single recipient output is 104.42787649 BTC at index 0 of transaction ada3bb…c5fcf9, confirmed in block 974223 at 06:41:47 UTC. The full record is preserved in Appendix C.

Read Figure 2 as a recipient-output summary, separate from Figure 1. Its panels compare one large output with the remaining six. There is deliberately no connecting arrow from Ethereum: the two addresses were disclosed in the same incident, but that fact alone does not establish a cross-chain conversion between them.

Figure 2. Seven returned recipient outputs, confirmed from 05:42:34 to 06:49:19 UTC on 2 November. Source: saved public Bitcoin transaction records. The total is a scoped sum of credits, not a proof of source ownership, current balance or incident-wide loss.

Several outputs are small. This review does not assign a purpose to those payments or assume every sender belongs to the exchange. The exact output sum is reproducible; the attribution of every input and any later spending require separate evidence. No Bitcoin downstream trace is claimed here.

5. Blocking assets and returning assets answer different questions

In its latest reviewed numerical update, Mercado Bitcoin said approximately $38 million in assets were involved and $11 million had been blocked with partners. Its companion statement assured customers they would not suffer asset losses. These are the exchange’s statements, read directly in the original public thread; they are not totals reconstructed by this report.

An issuer can restrict transfers of certain tokens under its contract rules. Such a restriction is different from sending assets back to the exchange, crediting customer accounts or completing a legal recovery. This report does not independently reproduce the exchange’s $11 million figure or the internal accounting behind its customer assurance. It also does not reconcile differing outside dollar estimates, whose pricing and coverage boundaries may differ.

SentinelTX corroborated the USDT and USDC transactions, including their full hashes, raw quantities and log indices. It also returned the initial and onward ETH values, but did not retain complete native-transaction anchors in its final evidence register. The native hashes in this article come from independent public-explorer checks. Its public Bitcoin and outbound-list responses were truncated, so the seven Bitcoin outputs and eight native outflows reported here rely on separately preserved public responses. Neither approach established an issuer restriction event, an Ethereum-to-Bitcoin conversion or a cash-out leg.

6. Findings, limits and the records needed next

Three bounded findings emerge. First, the selected Ethereum records distinguish an initial source transfer from later distribution. Second, the canonical USDT and USDC logs preserve precise token quantities even though the enclosing transactions transfer zero native ETH. Third, Bitcoin recipient outputs can be checked independently without inventing an Ethereum-to-Bitcoin route.

The initial intrusion mechanism remains unknown. Private-key extraction, access to a signing service and other authorization failures can produce signed transactions, but the selected records do not choose between those explanations. No claim is made about an attacker’s identity, shared ownership of downstream addresses, customer reimbursement, cash-out or the full ten-chain loss.

For the Ethereum branches, the useful next records are exact onward transfers and any service request that binds an input to a destination payment. For reported issuer restrictions, the useful evidence is the token contract, restriction event hash and block, plus a status observation at a stated cutoff. For the customer assurance, exchange accounting and restoration records would be needed. These are distinct questions; one successful transfer or one freeze event cannot answer them all.

Appendix A. Initial Ethereum evidence

Appendix B. Selected native ETH outflows

Every row has the exchange-disclosed Ethereum recipient as its sender. Quantities exclude transaction fees. Native ETH value is read from the transaction listing; similarly named tokens are excluded. The eight-row sum is 3,652.5 ETH.

Appendix C. Bitcoin recipient outputs

All seven selected outputs pay 19qGpsHvzh1t6pVi526XNNkh6hW6prDZp. The saved response contains seven returned transaction records; no completeness claim is made about all incident sources or later activity.

Sources and verification boundaries

Direct checks use the linked public Ethereum explorer, preserved Blockscout transaction and decoded-log responses, and public Bitcoin transaction responses. The exchange disclosure identifies the recipient addresses. Bitquery’s investigation supplied the source-wallet lead, whose operational attribution remains external. No outside headline total is adopted as a reconstructed loss. SentinelTX’s retained findings and their independent corroboration are distinguished in the body.