Post-hack, Mercado Bitcoin opens the lobby — but keeps the vault doors locked 🔐

Mercado Bitcoin began restoring read-only access to customer accounts in phases on Monday, one week after attackers drained an estimated $49 million from the Brazilian crypto exchange. A spokesperson told Cointelegraph that access would begin at 19:00 UTC, with all accounts expected to be viewable by 21:00 UTC, but the exchange has not announced when customers will be able to withdraw funds.

Customers will be able to see their holdings as they stood on Nov. 2, the day of the hack. In a video posted to the exchange’s X account, Fabricio Tota, vice president of new business, said Mercado Bitcoin hoped read-only access would reassure customers that their assets were still recorded on the platform. The exchange said it is using its own funds to replace the stolen assets and has pledged to cover all losses with company funds, bolstered by a $20 million investment from stablecoin issuer Tether in July.

Tota said the company chose “a more conservative approach” to reactivating accounts “to ensure our return happens with the utmost security.” He also said, “The vast majority of assets, in fact, nearly all of them, were never even touched by anyone; they were not even involved in the incident.” Blockchain security analysts indicated that the attackers accessed addresses and drained funds through standard transfers rather than exploiting a smart contract.

Mercado Bitcoin, one of Brazil’s largest crypto exchanges, told Brazilian magazine Veja in late October that it had more than 4.8 million customers and had processed over 215 billion Brazilian reais ($39 billion) in cumulative transactions. Blockchain analysts traced some stolen funds to customer deposit addresses, but the exchange says customers will not bear the losses. Tota also highlighted that a portion of the stolen funds were frozen shortly after the company announced an attack had taken place.

The next recovery phase requires users to confirm their registration details before they can move funds. Mercado Bitcoin plans to restore withdrawals via Pix, Brazil’s instant payment system, initially limiting withdrawals to accounts held in the customer’s own name, but has given no date for either step or explained how the attackers gained access to its wallets. As of Nov. 4, wallets linked to the attacker held most of the stolen funds that had escaped freezes, including 106.07 BTC, according to blockchain data company Bitquery.