When an exchange suspends movement of funds, the practical question for a holder is narrower than the headline loss: can you still see what the platform records, and what must happen before anything can leave the account? In reporting published on November 10, 2026, Cointelegraph described Mercado Bitcoin beginning a phased return of read-only access on Monday, a week after attackers drained an estimated $49 million. The exchange had not given a date for withdrawals to resume.
A Mercado Bitcoin spokesperson told Cointelegraph that access would begin at 19:00 UTC, with all accounts expected to be viewable by 21:00 UTC. Customers would see holdings as they stood on November 2, the day of the hack. In a video on the exchange’s X account, Fabricio Tota, vice president of new business, said the company hoped the read-only view would reassure customers that their assets were still recorded on the platform. He called the rollout “a more conservative approach” chosen “to ensure our return happens with the utmost security.”
Mercado Bitcoin, one of Brazil’s largest crypto exchanges, had told Brazilian magazine Veja in late October that it had more than 4.8 million customers and had processed over 215 billion Brazilian reais ($39 billion) in cumulative transactions. The exchange said it was using its own funds to replace the stolen assets. On November 4 it pledged to cover all losses with company funds, a capacity described as bolstered by a $20 million investment from stablecoin issuer Tether in July. Tota also said a portion of the stolen funds was frozen in the hours after the company announced the attack.
Blockchain security analysts had raised the concern that attackers reached addresses and drained funds through standard transfers rather than a smart-contract exploit. Analysts traced some of the stolen funds to customer deposit addresses. Mercado Bitcoin said customers would not bear the losses. In the video, Tota said: “The vast majority of assets, in fact, nearly all of them, were never even touched by anyone; they were not even involved in the incident.” Blockchain data company Bitquery found that, as of November 4, wallets it linked to the attacker held most of the stolen funds that had escaped freezes, including 106.07 BTC. The exchange had not explained how the attackers gained access to its wallets.
The next phase, also without a date from Tota, would require users to confirm registration details on the platform before they could move funds. Withdrawals were planned first via Pix, Brazil’s instant payment system, and initially only to accounts in the customer’s own name.
Read-only access restores visibility while the ability to transfer stays closed. That is a custody trade-off the report itself makes concrete: balances can be displayed from a November 2 snapshot even though the platform has not set a withdrawal time, has not explained the wallet access path, and has said customers will not be assigned the loss. The only forward checks described are the exchange’s own: confirm registration details, then—when withdrawals return—send funds first through Pix and only to an account in the same name. None of those steps, and not the pledge to replace assets with company funds, removes the risk of holding through an intermediary.
Original article: Cointelegraph, November 10, 2026
