What Can Mercado Bitcoin Customers Access?
Customers can currently view their total balances and asset positions through Mercado Bitcoin’s website, while the app provides a more limited portfolio overview.
Trading, deposits, withdrawals, crypto transfers, Pix, TED bank transfers, card services and new product subscriptions remain unavailable. Mercado Bitcoin said this staged approach is intended to allow security checks on each part of the platform before funds can move again.
The company had already outlined the phased recovery in its November 5 reopening plan, when it said read-only access would be the first milestone rather than a full return to operations.
The next stage is expected to include Pix transactions and payments related to its digital fixed-income products. Initially, Pix withdrawals will be restricted to Brazilian bank accounts held in the same name and CPF as the Mercado Bitcoin account.
Customers will also have to revalidate registration information and create new credentials through the Mercado Bitcoin app before they can move funds again. The exchange has not provided a date for that stage.
Investor Takeaway
Read-only access improves transparency but does not resolve the main liquidity question. The more important recovery milestone will be the return of withdrawals, particularly after customers have been unable to move assets for a full week.
How Much of the Stolen Crypto Has Been Blocked?
Blockchain analytics firm Bitquery estimates that approximately $48.6 million left Mercado Bitcoin-controlled wallets across 11 blockchains on November 2. Ethereum accounted for the largest share, followed by Bitcoin.
Mercado Bitcoin now says more than 33% of the diverted assets have been blocked through cooperation with organizations including Tether, Circle, Paxos, Stellar and blockchain investigators. The company says the portion that remains unrecovered represents approximately 3% of the total assets it held in custody before the incident.
Bitquery separately estimated that around $11.8 million had been frozen by token issuers during the early stages of the investigation. Its analysis also found that 36,042 Ethereum deposit addresses were emptied and that some transfers continued for several hours after Mercado Bitcoin publicly said the incident had been contained.
FinanceFeeds initially reported the breach on November 2 as blockchain investigators identified more than $46 million in suspicious outflows. Subsequent tracing raised the estimate toward $49 million.
Mercado Bitcoin maintains that customer balance records were not altered and says it is using company funds to replace the assets removed during the attack. The company has not disclosed the final financial cost of doing so.
Investor Takeaway
The recovery percentage reduces the exchange’s net exposure, but blocked assets are not the same as assets already returned. The eventual cost will depend on how much crypto can actually be recovered and what Mercado Bitcoin must purchase with its own capital to restore custody balances.
Can Mercado Bitcoin Absorb the Remaining Loss?
Mercado Bitcoin says it has already begun replenishing affected assets using its own resources and that approximately 97% of assets under custody were not affected by the incident.
The company points to roughly $300 million of investment received over its 13-year history, including backing from SoftBank and Mercado Libre’s Meli Fund. Stablecoin issuer Tether also made a $20 million strategic investment in Mercado Bitcoin in July.
Tether’s investment was intended to support Mercado Bitcoin’s expansion across tokenization, payments, lending, credit and capital markets rather than serve as a security reserve, but it adds context to the exchange’s available financial backing.
The attack has also raised unresolved technical questions. Bitquery found evidence that the attacker could sign transactions from customer deposit addresses as well as hot wallets, suggesting access extended beyond a single wallet. Mercado Bitcoin has not publicly explained how that access was obtained.
The company says only hot-wallet infrastructure was affected and that authorities and forensic specialists are investigating. It has not identified the attackers or disclosed whether compromised keys, internal systems or third-party infrastructure were responsible.
Investor Takeaway
The next major test is operational rather than informational. A clear technical explanation, completion of asset replenishment and a firm withdrawal date would provide stronger evidence of recovery than account visibility alone.
