Source published Nov. 10, 2026, at 02:25:29 UTC+8. This article covers the recovery status reported at that time.
Mercado Bitcoin began restoring read-only account access in phases on Monday, a week after attackers drained an estimated $49 million from the Brazilian crypto exchange. Customers were being allowed to view their recorded holdings, but the company had not provided a date for withdrawals to resume.
A spokesperson told Cointelegraph that access would begin at 19:00 UTC, with all accounts expected to be viewable by 21:00 UTC. The balances displayed would reflect holdings as they stood on Nov. 2, the day of the hack, rather than signal that customers could move their funds.
Account visibility is not full recovery
In a video posted to the exchange’s X account, Fabricio Tota, vice president of new business, said read-only access was intended to reassure customers that their assets remained recorded on the platform. He described the reopening as “a more conservative approach” intended “to ensure our return happens with the utmost security.”
The next recovery phase would require users to confirm their registration details before moving funds. Mercado Bitcoin planned to restore withdrawals through Pix, Brazil’s instant payment system, initially limiting transfers to accounts held in customers’ own names. Tota gave no date for either step.
For context on the platform’s scale, Mercado Bitcoin told Brazilian magazine Veja in late October that it had more than 4.8 million customers and had processed over 215 billion Brazilian reais ($39 billion) in cumulative transactions. Those figures describe its reported customer base and lifetime transaction volume—not active users, retention or the number of customers affected by the hack.
Loss coverage pledged; wallet breach remains unexplained
Mercado Bitcoin said it was replacing the stolen assets with its own funds and that customers would not bear the losses. It pledged on Nov. 4 to cover all losses with company funds, bolstered by a $20 million investment from stablecoin issuer Tether in July.
“The vast majority of assets, in fact, nearly all of them, were never even touched by anyone; they were not even involved in the incident,” Tota said. He also said a portion of the stolen funds had been frozen in the hours after the company announced the attack.
Blockchain security analysts raised concerns that attackers had accessed addresses and drained funds through standard transfers rather than a smart contract exploit. Analysts traced some stolen funds to customer deposit addresses, but the exchange had not explained how the attackers gained access to its wallets.
Blockchain data company Bitquery found that, as of Nov. 4, wallets it linked to the attacker held most of the stolen funds that had escaped freezes, including 106.07 BTC.
The reported reopening therefore marked a restoration of account visibility, not unrestricted access to funds. The timing of withdrawals and the explanation for the wallet breach remained unresolved.
