For Mercado Bitcoin customers waiting to regain access to their funds, the reopening offered visibility—not yet the ability to withdraw. As reported by Cointelegraph on Nov. 10, 2026, the exchange began restoring read-only account access in phases on Monday, a week after attackers drained an estimated $49 million.
The original report was published on Nov. 10, 2026, at 02:25:29 UTC+08:00. At that time, Mercado Bitcoin had not announced when withdrawals would resume.
What customers could see
A Mercado Bitcoin spokesperson told Cointelegraph that read-only access would begin at 19:00 UTC, with all accounts expected to be viewable by 21:00 UTC. Customers would see their holdings as recorded on Nov. 2, the day of the hack.
In a video on the exchange’s X account, Fabricio Tota, vice president of new business, said the company hoped this access would reassure customers that their assets remained recorded on the platform. However, viewing a recorded balance was not the same as being able to move those funds.
Tota said the exchange had chosen “a more conservative approach” to reactivating accounts “to ensure our return happens with the utmost security.”
Loss coverage and unanswered security questions
Mercado Bitcoin said it was using its own funds to replace the stolen assets and that customers would not bear the losses. It had pledged on Nov. 4 to cover all losses with company funds, bolstered by a $20 million investment from stablecoin issuer Tether in July.
“The vast majority of assets, in fact, nearly all of them, were never even touched by anyone; they were not even involved in the incident,” Tota said. He also said a portion of the stolen funds had been frozen in the hours after the company announced the attack.
Blockchain security analysts raised concerns that the attackers had accessed addresses and drained funds through standard transfers rather than a smart contract exploit. Analysts traced some of the stolen funds to customer deposit addresses.
Mercado Bitcoin had not explained how the attackers gained access to its wallets. Blockchain data company Bitquery found that, as of Nov. 4, wallets it linked to the attacker held most of the stolen funds that had escaped freezes, including 106.07 BTC.
What was planned before withdrawals could return
The next recovery phase would require users to confirm their registration details before moving funds. The exchange planned to restore withdrawals through Pix, Brazil’s instant payment system, initially limiting withdrawals to accounts in each customer’s own name. Tota provided no date for either step.
Mercado Bitcoin, one of Brazil’s largest crypto exchanges, had told Brazilian magazine Veja in late October that it served more than 4.8 million customers and had processed over 215 billion Brazilian reais ($39 billion) in cumulative transactions.
For customers assessing the reopening, the distinction remained important: account visibility, the exchange’s promise to cover losses, and restored withdrawal access were separate milestones. Only read-only access was being restored at the time of the report.