Mercado Bitcoin Restores Read-Only Access After $49M Attack

Mercado Bitcoin, one of Brazil's largest cryptocurrency exchanges, began restoring read-only access to customer accounts on Monday, more than a week after an attack moved roughly $49 million in customer assets — and withdrawals still have no restart date.

The staged restoration lets users view balances and holdings through Nov. 2. It does not permit transfers or withdrawals. The exchange has not said when customers will regain the ability to move funds.

What actually happened to the $49 million?

Security analysts who reviewed the on-chain movements described them as ordinary transfers rather than an exploit of a smart contract. That distinction matters for practitioners: the incident points to compromised wallet access or key management, not a flaw in a protocol or token contract.

Mercado Bitcoin has not explained how the attacker obtained wallet access. That gap leaves unresolved the most important operational question for any exchange custodian — whether the failure was procedural, human, or infrastructural.

Fabricio Tota, an executive at the exchange, said almost all assets were unaffected by the attack and that some of the stolen funds were frozen within hours after the exchange disclosed the incident. A partial freeze within that window suggests rapid coordination with counterparties or stablecoin issuers, though the exchange has not detailed which assets were recovered or where the freeze occurred.

What does the restoration change for customers?

For now, visibility only. Users can confirm their positions and balances through Nov. 2, which at least gives account holders a verifiable record ahead of the next phase. Before transfers resume, customers will have to confirm their account registration details — an identity re-verification step that effectively forces every user to pass a fresh compliance check before touching funds.

The exchange plans a specific sequencing for the withdrawal restart:

• Pix withdrawals — Brazil's instant payment rail — will be the first option restored.
• Transfers will be limited to accounts held in each customer's own name.

The same-name restriction is a containment measure. It narrows the paths stolen funds could take if attacker-controlled credentials are still live in the system, and it pushes any laundered outflow toward traceable, KYC'd Brazilian bank accounts.

Why the withdrawal timeline stays blank

The exchange has not announced when users can move money again, and the read-only window running only to Nov. 2 suggests Mercado Bitcoin is treating that date as a checkpoint rather than a resolution. Re-verification of the full customer base, sequencing Pix first, and enforcing same-name rails all take time to execute at scale.

The $49 million figure, for context, is not a rounding error for a mid-sized operation: it is roughly the scale of several of the largest exchange breaches recorded this year, and the partial freeze Tota described means the final net loss remains unquantified.

The practical test now is whether Mercado Bitcoin converts its Nov. 2 checkpoint into a functioning withdrawal channel — or extends the freeze again.