Mercado Bitcoin Restores Balances After $40 Million Loss

By Elena Vasquez

Mercado Bitcoin has said it will absorb a $40 million hot-wallet loss tied to a Nov. 2 security incident, and the Brazilian cryptocurrency exchange has reopened website access to customer balances. The restored pages show holdings from before the incident, while trading, deposits, withdrawals and transfers remain unavailable.

What can customers access now?

Mercado Bitcoin restored visibility into customer balances, not the ability to move or manage funds. The company says the balances reflect holdings recorded before the breach, which separates account display from transaction access. Customers cannot yet trade, deposit, withdraw or transfer funds through the services described in the update.

The exchange also canceled limit orders that remained open when it suspended operations. That removes outstanding instructions without providing a replacement execution. The update does not describe whether customers receive notice of the cancellations or how the exchange will handle replacement orders once trading resumes.

Takeaway: Customers can check what the exchange says they hold, but cannot act on those balances yet.

How will Mercado Bitcoin cover the loss?

Mercado Bitcoin said it is using its own funds to replace stolen assets and has committed to absorbing the $40 million loss. In its earlier response, the exchange said the attack targeted hot wallets and that it expected no customer losses. The statement treats the loss as a corporate cost, rather than a deduction from customer balances.

That commitment addresses the earlier no-loss expectation, but it does not document completed reimbursements. The disclosure also omits the method for identifying affected balances and whether stolen assets extend beyond the $40 million already identified.

The disclosure cites no attacker identity, on-chain record, forensic report, court filing or law-enforcement action. Without a count of affected customers, the $40 million figure cannot support a calculation of an average payout per account. The published evidence is therefore a company-backed coverage commitment, not completed reimbursement.

Takeaway: The exchange has promised to cover the loss, but has not published the reimbursement mechanics.

What restrictions will accompany withdrawals?

Mercado Bitcoin plans its next restoration phase for next week. Before customers can use their balances, they must verify their identities again in the app and set new passwords. The company also expects trading, crypto lending, staking, card services and crypto transfers to return in later phases, without giving a firm timetable for each.

Withdrawals in the next phase will operate under identity checks and account restrictions. Pix, Brazil's instant payment system, carries a temporary restriction limiting Brazilian-real withdrawals to accounts held in the customer's own name. The update does not say whether alternative payout routes remain available for customers without a matching account.

Takeaway: Next week brings a staged return, not unrestricted access to funds.

When will full service return?

The restoration schedule remains tied to next week's phase, followed by other services in later phases. Mercado Bitcoin has not provided a fixed date for trading, crypto lending, staking, card services or crypto transfers, so the reopening should not be read as a full operational recovery.

The open questions concern transaction limits, timing and the process for making displayed balances usable again. The immediate checkpoint is whether identity verification, new passwords and the own-name account restriction enable withdrawals without further interruptions.

A later recovery would require the exchange to restore trading and transfer functions while maintaining its pledge to use corporate funds in place of stolen assets. The current disclosure does not settle either outcome.

Takeaway: Next week's withdrawal phase is the first operational test; broader restoration remains conditional.