Mercado Bitcoin hack: attacker-linked wallets
A free, labelled dataset of wallets linked to the 2 November 2026 Mercado Bitcoin theft, updated as funds move.
Read the Chainlabs article
Check the list with your AI assistant
The dataset is available through the Chainlabs MCP server, so an AI agent can check addresses directly. No account or API key needed.
Server URL
https://mcp.chainlabs.ai/hacks/mercado-bitcoin/mcpClaude (web and desktop)
- Open Settings and go to Connectors.
- Choose to add a custom connector.
- Paste the server URL.
On Team and Enterprise plans, an owner adds the connector first.
Claude Code
Run this in your terminal:
claude mcp add --transport http chainlabs-mercado https://mcp.chainlabs.ai/hacks/mercado-bitcoin/mcpOther MCP clients
Add it as a remote HTTP server using the same URL.
Then ask, for example
- Is 0x… linked to the Mercado Bitcoin hack?
- List the hacker addresses on Tron.
If an address is not on the list, that only means Chainlabs has not linked it to this hack, not that it is safe. For bulk checks, use the CSV.
Get the CSV
Download the CSVWhat's in the file
One row per wallet on each chain, with the columns wallet, chain, category. A header row is included. A wallet used on several chains has a row for each. Addresses starting 0x are not all in the same case, so compare them without regard to case. Every Chainlabs attribution is supported by verifiable source evidence, available on request.
How up to date it is
Chainlabs updates the file as new wallets are found. The MCP server always returns the latest version.
How to use the dataset
Every wallet carries one of three categories. Treat each one differently.
| Category | What it means | What to do with it |
|---|---|---|
| hacker | Linked to the attacker. Received or moved stolen funds. | Block. |
| pre_hack_funder | Funded the attacker's addresses before the theft, but never received stolen funds. | Watch. Do not block on this alone. |
| victim | Mercado Bitcoin's own wallets the funds were taken from. | Do not block. |
By team
- Compliance teams: load the hacker rows into deposit screening.
- Engineering teams: pull the file on a schedule from the download link, which stays the same when the file is updated.
- Investigators: start tracing from the full set.
Want the wider Chainlabs dataset?
This hack feed is a small part of the Chainlabs label base: more than 510 million addresses, more than 30 blockchains, more than 800 regional exchanges and more than 2,000 OTC desks, updated daily. To license it, or to apply for the full Chainlabs MCP server, email mcp@chainlabs.ai. Access to the full server is by application.
Email mcp@chainlabs.aiFAQs
The Chainlabs dataset lists the wallets linked to the Mercado Bitcoin theft of 2 November 2026, with one row per wallet on each chain showing the wallet, its chain and its category. Every row carries one of three categories: hacker, pre_hack_funder or victim.
No. Chainlabs categorises each wallet so you can treat it differently. Block hacker wallets and never block victim wallets, which are Mercado Bitcoin's own. Watch pre-hack funders rather than blocking on that category alone.
Chainlabs updates the file as new wallets are found, and the Chainlabs MCP server always returns the latest version.
No. The Chainlabs dataset covers this incident only. If an address is not on the list, that only means Chainlabs has not linked it to this hack, not that it is safe.
Use the Chainlabs CSV in your own systems for bulk checks. AI assistants can make mistakes comparing long lists, so keep them for single addresses and short lists.
Email mcp@chainlabs.ai. Chainlabs licenses the wider dataset directly, and access to the full Chainlabs MCP server is by application.