Mercado Bitcoin reopens accounts a week after $49 million hack

Mercado Bitcoin, Brazil's largest crypto exchange, let customers see their account balances again on November 9, a week after a hack that cost it tens of millions of dollars. Trading stayed switched off. Withdrawals too.

Access came back in stages from 19:00 UTC, and the exchange said all accounts would be viewable by 21:00 UTC, according to a company update reported by Cointelegraph. Balances show where they stood on November 2, the day of the attack. People can look. They cannot touch.

What reopened, and what stayed shut

This first phase is narrow on purpose. Customers can log in through the website to view balances, statements and holdings, and little else. Fabricio Tota, vice president of new business at Mercado Bitcoin, said the firm took a 'more conservative approach' to switching accounts back on, and wanted 'to ensure our return happens with the utmost security.'

Fiat money moves before crypto. The exchange said it plans to bring back deposits and withdrawals in Brazilian reais through Pix, the country's instant payment system, and that early Pix withdrawals will be limited to bank accounts in the customer's own name. That control makes it harder to push funds straight to a stranger. A firm date? Not given. Crypto deposits and withdrawals stay suspended, and the exchange said trading and transfers will return only in later phases, after independent security testing.

Read-only access is not the same as cashing out. Customers can confirm a number on a screen and not much more. The money stays put.

A second warning went out too. Mercado Bitcoin told users to ignore unsolicited messages and anyone claiming to be support staff, a common second wave after an exchange is hit.

How much was stolen, and why the figures do not agree

Estimates of the theft do not line up. On-chain analytics firm Bitquery put the total at $48.6 million taken across 11 blockchains. Mercado Bitcoin's own updated FAQ gave a smaller number, about $36.3 million in affected assets. The gap is wide. The two sides have not reconciled it in public.

Bitquery said the losses did not stop when the exchange thought it had stopped them. The firm reported that 36,042 Ethereum deposit addresses were drained between 9:27 a.m. and 1:56 p.m. Brazil time on November 2, carrying on for nearly four hours after Mercado Bitcoin said at 9:56 a.m. that it had contained the breach. According to Bitquery, the withdrawals were signed straight from the deposit addresses, which points to the attacker holding the private keys or reaching a system that could sign for them. As of November 4, wallets linked to the attacker still held 106.07 bitcoin.

Not every dollar came from customers. Bitquery said the drained Ethereum deposit addresses held only about $266,000 between them, so most of the loss came from the exchange's own hot wallets rather than from individual customer deposits. That detail supports the company's line that customer balances were largely untouched. It does not prove it.

Mercado Bitcoin is not the only exchange hit lately. Weeks earlier the much larger platform Binance was struck by what reporters called a record breach, and its chief financial officer stepped down days later. Big venues hold the keys to a lot of other people's coins, which makes them a steady target.

How the attackers got in is still unexplained. Mercado Bitcoin has not said publicly how its systems were breached, only that it moved to contain the incident and told the authorities. That silence matters as much as the dollar figure.

Who pays for the missing coins

Mercado Bitcoin says customers will not foot the bill. On November 4 it pledged to replace the stolen assets with company funds, and Tota said 'the vast majority of assets, in fact, nearly all of them, were never even touched by anyone.' The exchange said industry partners had frozen more than $15 million of the stolen funds, with help from stablecoin issuers Tether, Circle and Paxos and the analytics firm Chainalysis.

Freezing works because some stablecoins are not fully free to move. Issuers like Tether and Circle can blacklist an address, which strands any of their tokens parked there. That power has limits. Bitcoin and many other coins have no central switch to flip, so once they are moved they are hard to claw back without an exchange or a court stepping in.

Deep pockets help here. Founded in 2013, the firm took a $200 million investment from SoftBank in 2021 that valued it near $2.1 billion, and Tether added another $20 million this July. Mercado Bitcoin says it serves more than 4.8 million customers and has handled over 215 billion reais, about $39 billion, in cumulative trades.

An old trade-off is back in view. Coins left on an exchange sit under someone else's control, which is part of why some holders prefer self-custody. The timing was rough too. Bitcoin (BTC) traded near $73,648 at 15:13 UTC on November 11, according to CoinGecko, close to its weakest level in about three months.

What to watch

Three things will show whether the reopening holds. The first is a date for Pix withdrawals, promised but not scheduled. The second is when, or whether, crypto withdrawals and trading come back, the part customers care about most. The third is a clear account of how the breach happened, which the exchange still owes its users and Brazil's regulators.

There is also the frozen money. Partners locked up part of the haul within hours, but clawing it back depends on cooperation across several chains and jurisdictions. The attacker still sat on 106 bitcoin in early November. Recovering that is far from certain.