Mercado Bitcoin to Resume Real Withdrawals After $49M Hack

Mercado Bitcoin, one of Brazil's largest cryptocurrency exchanges, will resume deposits and withdrawals in Brazilian reais via Pix next week, more than 15 days after an attack drained an estimated $49 million from wallets linked to the platform. A company representative confirmed the timeline to Cointelegraph.

The restart restores only the fiat side of the exchange's operations. Crypto deposits and withdrawals remain suspended, and the company has set no date for their return. Customers will face one structural restriction on the way out: withdrawals will be permitted only to bank accounts held in the customer's own name.

What does the restoration actually cover?

Three operational elements define the restart:

• Pix rails reopen: real-denominated deposits and withdrawals resume next week.
• Fixed income credits land: Mercado Bitcoin will credit customer accounts with proceeds from the settlement of fixed income products sold on the platform.
• Crypto rails stay closed: digital asset deposits and withdrawals remain suspended indefinitely.

The sequencing matters for practitioners. An exchange that restores fiat egress before crypto egress is prioritizing the withdrawal path most customers use first, while keeping the asset class at the center of the incident — the compromised wallets — locked down. The own-name account requirement functions as a compliance control: it forces identity verification at the withdrawal endpoint and narrows the routes through which stolen or commingled funds could leave the platform.

A phased recovery, week by week

The restart follows a staged restoration that began Monday, roughly a week after the attack, when Mercado Bitcoin allowed customers to view their accounts in read-only mode. That first step gave users visibility into their balances without granting any ability to move funds.

Customers who regain access land on a page detailing the exchange's security measures and its record of regular audits since 2018, alongside a link to a separate account of the incident. For a platform working to rebuild trust after a $49 million loss, that page does quiet reputational work: it reframes the incident against a longer operational history rather than as a standalone failure.

What changes for users and for the market?

For customers, the practical question is what they can do, and when. From next week, they can move reais out — but only to accounts in their own name, a constraint anyone withdrawing to a third-party or business account must plan around. Fixed income proceeds will appear as credits. Anyone whose strategy depends on moving crypto on-chain, however, remains in a holding pattern with no announced timeline.

For the broader Brazilian market, the incident tests how a major local exchange absorbs a nine-figure-in-real terms security failure. Brazil's instant payment infrastructure gives Mercado Bitcoin a credible fiat recovery path that exchanges in jurisdictions without an equivalent rails system would lack. The pace at which crypto withdrawals return — and whether withdrawals resume in full or with limits — will signal how complete the exchange's remediation actually is.

The next observable milestone is the Pix restart itself next week; the one after it, still undated, is the return of crypto withdrawals.