Mercado Bitcoin Reopens Accounts Read-Only a Week After an Estimated $49 Million Hack; Pix Withdrawals Come Next, With No Date

What reopened, and what did not

The first phase is narrow. According to PANews, which cited the exchange's post on X, customers can log back in through the website and see their total balance and asset breakdown. They cannot trade or perform other operations. ChainCatcher reported the same phase-one limits and added that trading and withdrawals will return in stages after security checks are complete.

Fabricio Tota, Mercado Bitcoin's vice president of new business, said in a video on the exchange's X account that the company chose "a more conservative approach" to reactivating accounts "to ensure our return happens with the utmost security," according to Cointelegraph. He said he hoped read-only access would reassure customers that their assets were still recorded on the platform.

Who pays for the loss

Mercado Bitcoin says customers will not bear the loss. According to Cointelegraph, the exchange pledged on November 4 to cover all losses with company funds, a commitment bolstered by a $20 million investment from stablecoin issuer Tether in July. PANews, citing the exchange's post, said balances will be restored with the company's own funds and updated as access returns and markets reopen.

"The vast majority of assets, in fact, nearly all of them, were never even touched by anyone; they were not even involved in the incident," Tota said in the video, as quoted by Cointelegraph. He also said part of the stolen funds was frozen in the hours after the company announced the attack.

The size of the loss depends on who is counting. Cointelegraph uses an estimate of $49 million. Odaily reported that media and on-chain analysts put it between $38 million and $46 million. Mercado Bitcoin has not published its own figure in the sources we opened.

For scale, Mercado Bitcoin told Brazilian magazine Veja in late October that it had more than 4.8 million customers and had processed over 215 billion reais (about $39 billion) in cumulative transactions, according to Cointelegraph. No independent audit of customer balances appears in the sources we opened.

How the week unfolded

The reopening makes more sense against the week behind it. Cointelegraph's earlier reports give the sequence.

Dickson Wu, a senior security engineer at CertiK, published an early post-mortem in which he said the attackers "picked at eight small chains for four hours," including Base, Optimism and Arbitrum, before moving to the exchange's main hot wallets, Cointelegraph reported on November 2. He described tiny ETH transfers from 27,160 different addresses and wrote: "So whoever did this can also move money out of MB's customer deposit addresses."

In its November 4 statement, Mercado Bitcoin said customers would first regain access to view balances, statements, holdings and investments, with transfers, withdrawals and trading to follow in later phases "subject to independent security testing," according to Cointelegraph's November 4 report. It also said: "Our trading desk is preparing to begin the necessary repurchases in domestic and international markets." The exchange has not said which assets it is buying back or in what amounts, so there is no way to estimate any effect on prices from the sources available.

How the attackers got in is still unknown

Mercado Bitcoin has not explained how the attackers gained access to its wallets, Cointelegraph reported. Blockchain security analysts said the attackers drained funds through standard transfers rather than a smart contract exploit, and analysts traced some of the stolen funds to customer deposit addresses.

Blockchain data company Bitquery found that, as of November 4, wallets it linked to the attacker held most of the stolen funds that had escaped freezes, including 106.07 BTC, according to the same report. At OKX's BTC-USDT price of $74,871.70 at 04:52 SGT on November 10, that BTC alone would be worth about $7.94 million (106.07 × $74,871.70). That is our arithmetic on a November 4 balance, not a current wallet reading.

The open question about access is why the registration check exists. If the attackers reached customer deposit addresses, the exchange has a reason to confirm who owns each account before releasing money, and to send Pix withdrawals only to accounts in the customer's own name.

What this means for you

If you have money on Mercado Bitcoin:

• Open the site by typing the official address into your browser. The exchange told users not to log in through links in other messages, according to PANews.
• Check your balance against your own records as of November 2: deposit receipts, trade confirmations, Pix statements and screenshots. Note any mismatch now, while the exchange is still reconciling.
• Avoid sending new crypto to a Mercado Bitcoin deposit address you saved before the hack. Wait until the exchange confirms deposits have reopened and shows you an address inside the logged-in app.
• Confirm that the bank account you plan to receive Pix withdrawals in is in your own name. The exchange says withdrawals will initially go only to such accounts.
• Ignore messages offering early withdrawal, "compensation" or recovery help. The exchange has announced no date, so any message that offers one should be treated as a scam.

If your coins are on another exchange such as Bitget, OKX or Binance, this incident is a reason to check the withdrawal-address allowlist and two-factor settings on your account, and to review which deposit addresses you have saved in other apps.

What to watch next

Three things would change the picture: a date for the registration check, a date for Pix withdrawals, and an explanation of how the attackers reached the wallets. A published loss figure from the exchange would also settle the gap between the $38 million to $49 million estimates. Until then, customers can see their balances but cannot move them.

A separate exchange, BitMart, said it was hacked a day after Mercado Bitcoin; that incident has its own timeline.

Quick answers

Can I withdraw from Mercado Bitcoin now?

No. As of November 10, accounts are read-only. The exchange says Pix withdrawals to accounts in your own name will come after a registration check, with no date given.

Will Mercado Bitcoin customers lose money?

The exchange says no: it pledged on November 4 to cover all losses with company funds, and says nearly all customer assets were untouched, according to Cointelegraph.

How much was stolen?

Estimates range from $38 million to $46 million (media and on-chain analysts, via Odaily) to about $49 million (Cointelegraph). The exchange has not published its own total in the sources we read.

When can I log in?

Access opened in phases from 19:00 UTC on November 9 (16:00 Brasília, 03:00 SGT on November 10), with all accounts expected by 21:00 UTC, according to the spokesperson quoted by Cointelegraph.