Mercado Bitcoin Resumes Operations After Hack, No Withdrawal Timeline

Brazilian crypto exchange Mercado Bitcoin has begun rolling back access to customer accounts in a read-only mode following last week’s reported hack that drained an estimated $49 million. The company said it started restoring visibility for users in phases on Monday, with the goal of letting customers confirm their balances before withdrawals are turned back on.

According to a spokesperson speaking to Cointelegraph, read-only access began at 19:00 UTC and was expected to be available for all accounts by 21:00 UTC. Customers will be able to view the state of their holdings as they were recorded on Nov. 2, the day the attack occurred. Mercado Bitcoin’s vice president of new business, Fabricio Tota, also said in a video posted to the exchange’s X account that the company hopes the phased approach will reassure customers that their assets remain properly tracked on the platform.

Key takeaways

• Mercado Bitcoin started phased restoration of read-only access to customer accounts Monday, targeting full visibility by 21:00 UTC.
• Users can view balances as recorded on Nov. 2, while withdrawals have not yet resumed.
• The exchange says it is handling losses with company funds and has not indicated a date for when customers can withdraw.
• Mercado Bitcoin plans the next recovery step to require users to confirm registration details before moving funds.
• Withdrawals are expected to be enabled initially via Pix, restricted to accounts in the customer’s own name.

Why Mercado Bitcoin is restoring access cautiously

Tota said the company is taking “a more conservative approach” to reactivating accounts, framing the decision as a security measure intended to ensure the exchange can complete its “return” with the “utmost security.” The cautious rollout comes as blockchain security analysts had raised concerns about how the incident unfolded.

In particular, analysts noted that the attackers appeared able to access addresses and drain funds using standard transfers rather than a smart contract exploit. That distinction matters for recovery planning: if funds moved through regular account flows, exchanges may need additional time to validate what was actually touched, what remains intact, and what additional controls are necessary before enabling user withdrawals.

Mercado Bitcoin has also addressed worries that customers might be impacted. Tota stated that “the vast majority of assets, in fact, nearly all of them, were never even touched by anyone” and were not involved in the incident. While some stolen funds were traced to deposit addresses, the exchange maintained that customers would not bear the losses.

Company-backed coverage and what has already been done

Mercado Bitcoin previously pledged to cover losses using its own funds. On Nov. 4, the exchange said it would cover all losses with company funds, a commitment that followed financial support already received earlier in the year. In July, Tether invested $20 million into Mercado Bitcoin.

Within the company’s recovery messaging, Tota also pointed to operational actions taken around the time of the breach. He said a portion of the stolen funds were frozen in the hours after the exchange announced that an attack had taken place, suggesting that some mitigation efforts were effective even before full details of the attack were understood.

What happens next: confirmations and Pix withdrawals

Read-only access is only one step in the exchange’s recovery process. The next phase will require users to confirm their registration details on the platform before they can move funds. Mercado Bitcoin did not provide a timeline for when that step will begin.

For withdrawals, the exchange plans to bring deposits and exits back through Pix, Brazil’s instant payment system. Initially, withdrawals are expected to be limited to accounts in the user’s own name, a control that can reduce the risk of funds being sent to accounts that were not properly verified or that could be linked to malicious activity.

Mercado Bitcoin has not given an exact date for when withdrawals will resume, meaning customers still cannot rely on a specific reopening schedule for moving funds off the exchange—even as they regain visibility into their balances.

Uncertainty remains over how attackers accessed wallets

Despite the company’s assurances and ongoing read-only restoration, Mercado Bitcoin has not explained how the attackers gained access to its wallets. That open question is central to assessing whether similar attacks could recur.

Blockchain intelligence firm Bitquery previously reported that as of Nov. 4, wallets it linked to the attacker held most of the stolen funds that had escaped freezes, including 106.07 BTC. While that provides some clarity on where remaining funds were believed to be located at that point, it does not, by itself, resolve how the initial breach occurred or what security gap allowed access.

For users and risk-focused investors, the key issue going forward is whether Mercado Bitcoin’s recovery includes not only restoring balances but also closing the underlying access pathway. Until the exchange details the root cause—or demonstrates that wallet access can’t be replicated—there will likely be lingering uncertainty about the resilience of its infrastructure.

Customers should watch for the next milestones Mercado Bitcoin has signaled: when registration confirmations go live and when withdrawals via Pix begin, along with any further explanation of the breach mechanism. The phased restoration of read-only access is a promising step, but the real test for trust will be the reliability and security of withdrawals once they’re enabled.