Mercado Bitcoin Restores Account Access November 9 Post-Breach

The exchange suspended all transactions on November 2 after detecting unauthorized access to one of its systems. It says the incident has been contained and that no customer funds or data were lost, but it has not said which system was compromised.

Read-Only Access, With Everything Else Still Off

From November 9, customers can view their holdings on the website, broken down by asset and category. The app will show an overview only. Balances reflect each account’s status immediately before the November 2 incident, and Brazilian real valuations use prices from that same moment. Someone with a $50,000 portfolio on November 2 will see that exact figure a week later, whatever the market has done since.

Almost everything else remains suspended, with no timeline announced:

• Trading, deposits and withdrawals
• Pix, TED transfers and card operations
• API access, which the exchange says will return later
• Ethereum staking, which was halted for security reasons and generated no yield during the outage

Open limit orders were canceled outright, so customers will need to place new ones once trading resumes. Other staking products and digital-dollar passive-income products kept accruing returns, and those will be credited when the products become active again. The exchange’s FAQ places Pix and digital fixed-income payments in a later recovery stage, then trading and crypto transfers in a stage after that, without dates for either.

Before any balance movements resume, every customer must reconfirm their registration information and create a new password through the app. The exchange also warns users to type the official website address directly into their browser and to ignore any balance-release links or password requests that arrive from outside the platform.

What the Chain Shows

The exchange was hacked for at least $46 million, with an attacker draining hot wallets across at least ten blockchains starting on November 2. On-chain records show the speed of it:

• 2,852 ETH ($6.52 million), $2.99 million in USDT and $2.24 million in USDC taken within minutes
• 104.43 BTC ($8.16 million) swept from the Bitcoin hot wallet
• SOL, TRX, stablecoins on Tron and Solana, and dozens of ERC-20 tokens including PEPE, ONDO, PENDLE, VIRTUAL and UNI

A wallet the exchange identified in connection with the breach sent 2,800 ETH and 2.24 million USDC to separate addresses on November 2. The same Ethereum wallet also moved 373 billion PEPE and 130 ETH elsewhere. Mercado Bitcoin says it is using company funds to replace the affected assets and that customer records are intact.

Hashlytics Take

“No customer funds were lost” is a statement about who absorbs the loss, not about whether assets left the building, and the on-chain record shows they did. That distinction matters because the whole recovery now rests on the exchange’s own balance sheet. The mandatory password reset and the staged reopening read like a company that is treating credentials as potentially exposed, whatever the official line says. The detail to watch is the missing timeline. A drain across at least ten chains within minutes suggests the attacker controlled signing infrastructure rather than exploiting a single chain-level flaw, though the exchange has not confirmed that. Until it names the compromised system and puts dates on trading and withdrawals, customers are looking at frozen numbers in a market that is not frozen.