Mercado Bitcoin restores read-only access after estimated $49 million hack

Mercado Bitcoin started reopening customer accounts for viewing only in stages on Monday, one week after attackers stole an estimated $49 million. A Mercado Bitcoin spokesperson said access would start at 19:00 UTC, with every account expected to become viewable by 21:00 UTC. The spokesperson said customers would see holdings recorded on Nov. 2, the date of the hack. Mercado Bitcoin has not announced when customers can withdraw funds.

Fabricio Tota, vice president of new business, said in a video that Mercado Bitcoin hoped viewing access would reassure customers that the platform still recorded customer assets. Tota said Mercado Bitcoin chose a cautious approach to account reactivation to maximize security. Blockchain security analysts had raised concerns that attackers accessed addresses and moved funds through ordinary transfers, rather than exploiting a smart contract. Mercado Bitcoin has not explained how the attackers accessed the exchange's wallets.

Blockchain analysts traced part of the stolen funds to customer deposit addresses. However, Mercado Bitcoin says customers will not absorb the losses. Tota said nearly all assets remained untouched and were not involved in the incident. Mercado Bitcoin says the exchange is replacing the stolen assets with company funds. Mercado Bitcoin pledged on Nov. 4 to use company funds to cover every loss. Tether, a stablecoin issuer, had strengthened Mercado Bitcoin's finances with a $20 million investment in July. Tota said some stolen funds were frozen within hours after Mercado Bitcoin announced the attack.

The next recovery stage will require customers to verify registration information before moving funds. Mercado Bitcoin plans to resume withdrawals through Pix, Brazil's instant payment system. The initial withdrawal rules will allow transfers only to accounts bearing the customer's own name. Tota provided no date for registration verification or the resumption of withdrawals. Blockchain data company Bitquery found that, as of Nov. 4, wallets Bitquery associated with the attacker retained most stolen funds that escaped freezing, including 106.07 BTC.

Mercado Bitcoin ranks among Brazil's largest crypto exchanges. Mercado Bitcoin told the magazine Veja in late October that the exchange served more than 4.8 million customers. Mercado Bitcoin also told Veja that cumulative transaction volume exceeded 215 billion Brazilian reais ($39 billion).