Mercado Bitcoin Attacker Swaps Stolen Funds for $10.55M in ETH via MetaMask Router
TREE NEWS reports: Two days after a $46 million exploit against Brazilian exchange Mercado Bitcoin, the attacker’s associated wallets have been actively converting stolen assets into Ethereum. The attacker conducted 338 swaps through MetaMask Router, acquiring 4,605 ETH valued at approximately $10.55 million. The assets continue to move across multiple addresses, indicating an ongoing effort to obfuscate the trail.
Swap Mechanics and On-Chain Footprint
The use of MetaMask Router—a decentralized exchange aggregator—suggests the attacker is leveraging permissionless liquidity to avoid centralized exchange scrutiny. By executing hundreds of small swaps, the attacker likely aims to minimize slippage and avoid triggering automated surveillance alerts. The 4,605 ETH haul represents nearly a quarter of the stolen $46 million, with the remainder presumably still held in other tokens or stablecoins.
On-chain sleuths have traced the flow to a network of wallets, but the ultimate destination remains unclear. The attacker may be preparing to bridge the funds to privacy-focused chains or mixers, a common tactic in high-profile exploits.
Industry Implications: DeFi’s Double-Edged Sword
This incident underscores the persistent vulnerability of centralized exchanges and custodians to sophisticated attacks. Mercado Bitcoin, one of Latin America’s largest crypto platforms, has yet to disclose the exact attack vector, but the scale of the breach raises questions about hot wallet security and key management practices.
Moreover, the attacker’s reliance on DeFi infrastructure highlights the tension between permissionless innovation and illicit finance. While DEX aggregators like MetaMask Router offer legitimate users seamless swaps, they also provide a degree of anonymity that bad actors exploit. Regulators worldwide are increasingly scrutinizing DeFi protocols for anti-money laundering (AML) compliance, and incidents like this add fuel to the argument for stricter oversight.
Forward-Looking: Tracing and Recovery Efforts
Blockchain analytics firms are collaborating with law enforcement to track the stolen funds. However, once assets are swapped into ETH and dispersed across numerous wallets, recovery becomes exponentially harder. The attacker may attempt to use coin mixers or cross-chain bridges to further obscure the trail, but these services are under growing pressure from regulators to implement KYC.
For Mercado Bitcoin, the priority is to reassure users and strengthen security. The exchange may need to reimburse affected customers, which could strain its balance sheet. In the broader market, the incident serves as a reminder that even established players remain targets, and that DeFi’s composability, while powerful, can be weaponized by adversaries.
