Key takeaways
- Investigators identify 6.7 million XLM in attacker wallet
- Mercado Bitcoin suspends withdrawals following multichain security breach
- Stellar network remains unaffected by exchange wallet compromise
Approximately 6.7 million Stellar (XLM) tokens have been traced to a wallet associated with Mercado Bitcoin's security breach, as investigators uncover evidence of cryptocurrency theft across at least ten blockchain networks.
According to Bitquery's investigation, the attacker's Stellar address held approximately 6.71 million XLM alongside 979,527 USDC following the November 2 incident.
Initial estimates from blockchain security firm Hypernative placed suspicious transfers above $40 million, while subsequent analysis identified approximately $48.5 million in assets leaving exchange-linked wallets.
The incident comes as Stellar's tokenization ecosystem continues expanding, although investigators have found no evidence that Stellar's underlying blockchain was compromised.
Stellar Wallet Holds 6.7 Million XLM After Mercado Bitcoin Attack
Mercado Bitcoin confirmed a security incident on November 2, temporarily suspending cryptocurrency deposits and withdrawals while investigating unauthorized activity.
The Brazilian exchange subsequently published destination addresses across Stellar, Bitcoin, Solana, Tron and Ethereum-compatible networks to help blockchain investigators track suspicious transactions.
Hypernative identified approximately 106 BTC, 2,852 ETH, 10,700 SOL and 6.7 million XLM among assets associated with the attacker.
Most initial transfers occurred between 06:19 and 06:53 UTC, suggesting a coordinated operation across multiple networks.
Bitquery later reported that Ethereum alone accounted for approximately $29.5 million in suspicious transfers, making it the largest identified component.
The multichain incident follows the recent Binance wallet breach, which also involved unauthorized transfers across several cryptocurrency networks.
However, investigators have not established any connection between the attacks.
Mercado Bitcoin Says Customer Funds Remain Protected
Mercado Bitcoin stated that customers suffered no financial losses and that the incident did not expose personal information.
However, the exchange has not confirmed the total amount stolen or explained how the attacker obtained transaction-signing access.
The breach also raises questions about operational security at a company involved in institutional blockchain development.
Mercado Bitcoin previously announced a $200 million tokenization initiative on the XRP Ledger and subsequently received a $20 million investment from Tether.
Neither partnership establishes that the associated blockchain infrastructure was affected.
Stablecoin Freezes Complicate Recovery of Stolen XLM
Blockchain investigators are coordinating efforts to recover assets transferred during the breach.
Chainalysis reported working with Ripple, Tether, Circle and other companies to identify stolen funds, helping freeze more than $9 million in USDT.
These interventions resemble earlier RLUSD recovery efforts following Binance's security incident.
However, native XLM cannot be frozen through the same issuer-controlled mechanisms used by centralized stablecoins.
That distinction makes exchange cooperation and transaction monitoring especially important when attempting to recover stolen Stellar tokens.
The latest incident also underscores the importance of reserve transparency after Binance's recovery efforts.
