Mercado Bitcoin, one of Brazil’s largest cryptocurrency exchanges, has started restoring customer account access in a phased approach after a security breach resulted in an estimated $49 million loss. The company began enabling read-only access for users on Monday, allowing clients to view their digital asset balances as of November 2, the date the hack occurred.
Restoration and Customer Reassurance
The phased reopening began at 19:00 UTC, with Mercado Bitcoin expecting all accounts to be accessible in view-only mode by 21:00 UTC. Customers can now verify their account balances as they appeared prior to the incident, though withdrawals remain suspended and no date has been provided for when such transactions will resume.
In a video message published on the company’s official social media channels, Fabricio Tota, vice president of new business, stated that Mercado Bitcoin aims to provide transparency by enabling clients to verify that their assets are still recorded on the platform.
“The vast majority of assets, in fact, nearly all of them, were never even touched by anyone; they were not even involved in the incident,” Tota said, emphasizing that customer losses would be covered by the company’s own funds.
Mini dictionary: Mercado Bitcoin is a leading cryptocurrency exchange in Brazil, serving millions of users and facilitating billions of dollars in cumulative transactions through its trading platform.
Security Measures and Next Steps
The company has opted for a conservative approach in reactivating accounts, prioritizing platform security. Tota explained that these steps are necessary to ensure a secure and gradual restoration of services given the nature of the breach, which involved attackers accessing customer deposit addresses and transferring funds through standard transactions instead of exploiting a smart contract vulnerability.
Blockchain security specialists tracking the stolen funds found that some assets were moved to user deposit addresses, fueling concerns about the methods used by the perpetrators. However, Mercado Bitcoin reiterated its commitment to fully compensate affected clients, using company reserves to restore customer balances.
On November 4, Mercado Bitcoin announced it would cover the losses from its own funds. This pledge is backed by a $20 million investment the exchange received from Tether, a stablecoin issuer, in July. According to Tota, a portion of the stolen cryptocurrencies was frozen within hours of the breach disclosure.
Future Recovery and Withdrawal Plans
The next phase in the recovery process will require users to reconfirm their registration details as a security measure before the reinstatement of withdrawal privileges. Mercado Bitcoin intends to initially allow withdrawals via Pix, Brazil’s instant payment infrastructure, restricting such transactions to user-owned accounts to further bolster safety. No specific timeline has been given for when these withdrawal options will become available.
Despite these developments, the exchange has not clarified how the attackers managed to access and compromise its wallets. Data from blockchain analytics firm Bitquery showed that as of November 4, wallets associated with the attacker continued to hold most of the stolen digital assets that had not been intercepted, including 106.07 BTC.
Mercado Bitcoin stated that it is working closely with blockchain investigators to track and freeze assets involved in the breach, aiming to secure client interests and prevent further losses.
