Mercado Bitcoin Hack

In short: Chainlabs is publishing a free, labelled dataset of the wallets linked to the Mercado Bitcoin theft of 2 November 2026: the hacker wallets on every chain the funds moved through, the wallets that funded the attacker before the theft, and the victim wallets. Chainlabs will keep the dataset current as the funds move. Anyone who screens deposits, traces funds or investigates this case can use it and build on it.

What happened at Mercado Bitcoin?

On 2 November 2026, attackers drained Mercado Bitcoin's hot wallets across at least seven chains in about 25 minutes, in what Bloomberg Línea reported as a US$40 million attack. Tens of thousands of customer deposit addresses were swept later that day. The attack had been prepared the evening before, when the attackers funded their addresses and tested them with small payments. Stablecoin issuers have since frozen part of the funds, while the rest have been sold, bridged and consolidated. Mercado Bitcoin says customers will not bear the losses. Mercado Bitcoin and public analytics firms have published a handful of attacker addresses; the Chainlabs dataset holds several times as many.

What is in the dataset?

One CSV with three columns: wallet, chain and category. A wallet the attacker used on several EVM chains has one row per chain.

Category	What it means	What to do with it
Hacker	A wallet controlled by the attacker that received stolen funds, whether it moved them on or still holds them. Includes the addresses already public.	Block deposits from it. Alert on any transfer to a venue you recognise.
Pre-hack funder	A wallet that funded or tested the attacker's addresses the night before and never received stolen funds.	Do not block on this alone. Keep on watch: if it funds another attack, the link is already made.
Victim	Mercado Bitcoin's own hot and operational wallets the funds were taken from.	Do not block. Use it to recognise legitimate Mercado Bitcoin flows.

A wallet is categorised as "hacker" only if the attacker controls it, not simply because it was paid. Attackers send funds to addresses they do not control to mislead anyone following the money, so a list of everything the attacker paid would label innocent third parties. Look-alike tokens and addresses used for poisoning are kept out. The list was produced twice, by two Chainlabs analysts working independently, then merged, and all 101 rows were re-checked on-chain before they went in. For more on how labels are made and how far to trust them, read Where crypto labels come from, and why your AI agent needs to know.

The swept customer deposit addresses are deliberately not in the file. They are victims, and publishing them would help nobody.

What can you do with it?

• Screen. Load the hacker rows into your KYT or deposit-screening rules and pull the latest version from the MCP or the CSV, since the attacker opens new wallets daily.
• Trace. Start your own tracing from the full set of attacker wallets rather than the public handful, and follow the hops that matter to you.
• Request records. The bridges and swap services the funds passed through hold order records for transfers to and from the hacker wallets.
• Attribute the next one. The pre-hack funder wallets are the rows to match against the next theft.

Why is Chainlabs publishing this for free, and keeping it current?

Stolen funds are only recoverable while they are still on-chain, and the window closes at the first exchange, OTC desk or payment provider that takes a deposit without checking. Screening against the public handful of addresses leaves most doors open. Chainlabs has the fuller list and sees no reason to keep it behind a paywall while the money is moving. The industry is also better off working from one shared, evidenced list than from a dozen partial ones.

The dataset is maintained, and we add new wallets as we find them.

Get the data

The Mercado Bitcoin dataset is free. Download the CSV, or connect to the dataset through the Chainlabs MCP server, at chainlabs.ai/mercado-bitcoin-hack-2026. The CSV and the MCP connection serve the same file, so both always give you the latest version.

The broader Chainlabs dataset. The hack feed is a small cut of the Chainlabs label base: more than 510 million addresses, more than 30 blockchains, more than 800 regional exchanges and more than 2,000 OTC desks, including more than 50 OTC desks and local exchanges in Brazil, updated daily. To license it, or for continuous screening of attacker addresses against it, email mcp@chainlabs.ai.

The Chainlabs MCP server. Chainlabs is building an MCP server that brings the same label base into Claude or any AI agent that supports MCP. Every attribution carries a confidence level, High, Medium or Low, with evidence available on request. It starts with Bitcoin, with Ethereum to follow. Access is by application: email mcp@chainlabs.ai with a few lines about your work and the chains you investigate.

Who is Chainlabs?

Chainlabs identifies who is behind blockchain addresses. It licenses evidence-backed entity data to compliance, analytics and investigation teams, covering more than 510 million labelled addresses across more than 30 blockchains. An estimated 90% of the KYT market runs on Chainlabs data, and every attribution is supported by verifiable source evidence, available on request.

That data is strongest where a case like this is decided. Stolen funds rarely cash out at a top-ten exchange. They go to regional exchanges, OTC desks, payment processors and crypto ATMs outside the big platforms' coverage. Chainlabs labels more than 800 regional exchanges and more than 2,000 OTC desks worldwide, and in Brazil it has labelled wallets for more than 50 OTC desks and local exchanges: the venues where funds from a Brazilian exchange hack are most likely to surface. Those labels turn "funds moved to an unknown wallet" into "funds deposited at a desk that holds the customer's identity".

Want to use this data in your own investigations? Book a call with our team.