Mercado Bitcoin Restores Read-Only Access After $49 Million Hack

Mercado Bitcoin began restoring read-only customer accounts in phases on Monday, a week after attackers drained an estimated $49 million from the exchange, according to Cointelegraph. The Brazilian crypto exchange still has not said when customers can withdraw funds.

At 19:00 UTC, customer pages began reopening in read-only mode, a Mercado Bitcoin spokesperson told Cointelegraph. The company expected every account to be viewable by 21:00 UTC. Customers can see their holdings as they stood on Nov. 2, the day of the hack.

In a video posted to the exchange’s X account, Fabricio Tota, vice president of new business, said the read-only return should reassure customers that their assets remained recorded on the platform. The measure gives users visibility without returning control of their money.

What does the partial reopening change?

For now, the reopening changes what customers can verify, not what they can move. Tota said Mercado Bitcoin chose “a more conservative approach” to reactivating accounts “to ensure our return happens with the utmost security.”

The phased schedule puts account visibility ahead of fund movement. Read-only access exposes platform records to account holders, but it does not restore withdrawal rights. For customers, this remains a balance check rather than a cash-out window.

The next phase requires users to confirm their registration details. Withdrawals will run through Pix, Brazil’s instant payment system, and initially only to accounts in the customer’s own name. Tota gave no date for either step, so the exchange has set no public withdrawal deadline.

Those controls define the initial recovery perimeter. Customers must reconfirm who they are before any funds move. The same-name restriction then narrows the first payout channel to Pix accounts matching the verified customer record, rather than third-party destinations.

The wallet-access failure remains unexplained

Blockchain security analysts cited in the report were concerned that the attackers accessed addresses and drained funds through standard transfers rather than a smart-contract exploit. Blockchain analysts traced some stolen funds to customer deposit addresses. The concern centered on address access, but Mercado Bitcoin has not explained how the attackers gained access to its wallets.

That distinction leaves the central security question unresolved. The reported mechanism involved ordinary transfers from reachable addresses, not faulty contract code. The exact point of failure remains outside the exchange’s public account.

Customers are promised full reimbursement

Mercado Bitcoin says customers will not bear the losses. On Nov. 4, the exchange pledged to replace all stolen assets with company funds. Its capacity to do so was bolstered by a $20 million investment from stablecoin issuer Tether in July.

Tota also said a portion of the stolen funds was frozen in the hours after the company announced an attack had taken place. He sought to separate that theft from customer holdings: “The vast majority of assets, in fact, nearly all of them, were never even touched by anyone; they were not even involved in the incident.”

Scale of the affected platform

Mercado Bitcoin, one of Brazil’s largest crypto exchanges, told Brazilian magazine Veja in late October that it had more than 4.8 million customers. It had processed over 215 billion Brazilian reais, or $39 billion, in cumulative transactions.

Those figures put the withdrawal freeze in the context of a platform with a broad user base. They also show why restoring records and withdrawals are separate operational tasks: the first lets customers confirm balances, while the second requires identity checks and payment-account controls.

The stolen funds remain partly traceable

Blockchain data company Bitquery found that, as of Nov. 4, wallets it linked to the attacker held most of the stolen funds that had escaped freezes, including 106.07 BTC. The $49 million figure is the estimated total drain, while the 106.07 BTC figure comes from Bitquery’s Nov. 4 on-chain snapshot. They are not interchangeable measures of the loss.

The next operational test

The next test is operational: complete registration checks, enable same-name Pix withdrawals and explain the wallet-access failure. Mercado Bitcoin has published no dates for those steps. Until it does, customers remain limited to read-only access, and the recovery has no fixed public deadline.