Mercado Bitcoin, the largest cryptocurrency exchange in Brazil, allowed customers to log back into their accounts on Monday, following a $48.6 million security breach that hit its wallets a week prior.
Account access restored, trading functions remain paused
Starting from 16:00 local time, Mercado Bitcoin reopened its web logins, enabling users to view account balances, portfolio value, and investment breakdowns by asset and category. By 18:00, all customer accounts were accessible for balance checking.
Despite restored login capability, all trading, deposits, withdrawals, transfers, and new account registrations remain temporarily unavailable. API access, MB card functions, and financial services such as Pix and TED payments are still on hold.
The exchange is taking a phased approach to relaunching its operations. Each phase will be subject to additional security verifications before more services are brought back online. Mercado Bitcoin stated that balance visibility is its initial focus, pending further security validation on other account operations.
Mercado Bitcoin stated that customers can only monitor their overall portfolio, specific holdings, and asset categories while waiting for the full return of services.
Information posted in the company’s updated help-center FAQ clarified that, once withdrawals resume, Pix withdrawals will first be restricted to accounts matching each user’s name and CPF tax ID. Before regaining access to account assets, all users will need to revalidate their account details and reset their passwords using the Mercado Bitcoin app.
Displayed balances will reflect users’ positions as of November 2, prior to the hack.
Coverage of stolen crypto and ongoing investigation
Mercado Bitcoin assured users that no customer funds will be lost. The exchange committed to using its own capital to replace all stolen cryptocurrencies. Fabrício Tota, vice president of new business, stated in a video that the company is repurchasing crypto assets from both domestic and international partners to replenish its reserves.
Mercado Bitcoin has around $300 million in capital raised since its inception, including a $20 million investment from stablecoin issuer Tether in July, providing financial resources to cover the losses. Over 33% of the stolen funds have been frozen, while about 3% of the exchange’s total custody remains unrecovered. Tota estimated that the hacker still controls approximately $33 million.
Bitquery, a blockchain data platform, tracked the stolen $48.6 million across 11 blockchains and reported that the attacker managed to withdraw assets from 36,042 Ethereum addresses, due to being able to sign for customer deposit addresses. The theft reportedly lasted for about four hours beyond the exchange’s initial containment announcement. Stablecoin firms including Tether, Circle, and Paxos froze roughly $11.8 million of the stolen assets.
This incident followed a significant $6.3 billion hack targeting Binance, one of the world’s largest exchanges, on October 29. BitMart, another crypto platform, also suffered a breach on the same day, though with smaller losses. BitMart founder Sheldon Xia stated that a single group may be behind all these attacks.
Mini dictionary: Mercado Bitcoin is Brazil’s largest cryptocurrency exchange, providing trading and custody services for digital assets with a significant user base in Latin America.
| Exchange | Date of Attack | Amount Stolen | Funds Recovered or Frozen |
|---|---|---|---|
| Mercado Bitcoin | November 2, 2023 | $48.6 million | Over 33% |
| Binance | October 29, 2023 | $6.3 billion | Not specified |
| BitMart | October 29, 2023 | Less than Mercado Bitcoin | Not specified |
