Pavlo Kot

Mercado Bitcoin starts phased account reopening after hack, withdrawals still pending

Mercado Bitcoin starts phased account reopening after hack, withdrawals still pending
Mercado Bitcoin resumes access

A week after a cyberattack drained an estimated $49 million from Mercado Bitcoin, the Brazilian crypto exchange is beginning to restore customer access in stages. Users can initially only view balances recorded on Nov. 2, while the company still gives no timeline for reopening withdrawals.

Highlights

  • Mercado Bitcoin restored read-only access to all customer accounts as of Nov. 6, showing balances as of the Nov. 2 hack, but withdrawals remain suspended.
  • Mercado Bitcoin will cover all customer losses using company funds, with assets replaced and withdrawal restoration through Pix planned, but no specific timeline provided.
  • Wallets linked to the Mercado Bitcoin attacker still hold most unfrozen stolen funds, including 106.07 BTC, as of Nov. 4 according to Bitquery.

Phased reopening begins with read-only access

As reported by Cointelegraph, Mercado Bitcoin starts restoring read-only access to customer accounts on Monday from 19:00 UTC, with all accounts expected to be viewable by 21:00 UTC. Customers can see their holdings as they stood on Nov. 2, the day of the hack, but they still cannot move funds from the platform.

In a video posted on the exchange’s X account, Fabricio Tota, vice president of new business, says the limited reopening is meant to reassure customers that their assets remain recorded on the exchange. He says the company chose "a more conservative approach" so that the return happens with maximum security after attackers used wallet access to drain funds through standard transfers rather than through a smart contract exploit.

Mercado Bitcoin says customers will not bear the losses and that it is using company funds to replace the stolen assets. Tota also says most assets were never touched in the incident, while part of the stolen funds was frozen within hours after the company disclosed the attack.

Recovery plan leaves withdrawal timing unclear

The next stage of the recovery requires users to confirm their registration details before they are allowed to move funds. Mercado Bitcoin plans to restore withdrawals through Pix, Brazil’s instant payment system, initially limiting transfers to bank accounts held in the customer’s own name, but Tota gives no date for either step.

Mercado Bitcoin, one of Brazil’s largest crypto exchanges, told Veja in late October that it had more than 4.8 million customers and had processed more than 215 billion reais, about $39 billion, in cumulative transactions. On Nov. 4, the company pledged to cover all losses with its own funds, supported by a $20 million investment from stablecoin issuer Tether in July.

Questions remain over how the attackers gained access to the exchange’s wallets. Blockchain data company Bitquery says that, as of Nov. 4, wallets linked to the attacker still hold most of the stolen funds that were not frozen, including 106.07 BTC.

Earlier, we reported that global cybersecurity and privacy startups raised $6.8 billion in Q3, boosted by larger late-stage rounds.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.