Mercado Bitcoin plans to begin restoring customer account access Monday after a breach that analysts estimated resulted in losses of more than $46 million. As of November 5, 2026, the announced first step is website access to view holdings. Cointelegraph reports that withdrawals, transfers and trading will return in later phases, subject to independent security testing.
The exchange in Brazil also says it will use company funds to replenish affected assets. Its recovery plan separates two customer concerns: whether account balances will be made whole and when customers can use those balances again. The reimbursement pledge addresses the first. The phased reopening leaves the second dependent on security checks.
Monday begins with account viewing
Customers will initially be able to review balances, statements, holdings and investments through the website, according to Mercado Bitcoin's statement to Cointelegraph. That gives customers a way to inspect their accounts before transaction functions return.
For someone waiting to move funds, the practical constraint remains. A visible balance is still unavailable for withdrawal while that function is suspended. Customers who need access to money held at the exchange therefore face a longer wait than the Monday reopening headline might suggest.
Independent testing is the stated condition for later phases. Reopening will require a sequence of operational decisions. Account information can become accessible while the systems that authorize asset movements remain restricted.
That separation is particularly relevant after an attack involving wallet transfers. Restoring a website and restoring the ability to send assets expose different functions. Mercado Bitcoin's timetable keeps those functions separate while it works toward resuming transactions.
Company funds carry the reimbursement pledge
Mercado Bitcoin says its trading desk is preparing to repurchase affected assets in domestic and international markets. The announcement describes an asset replacement process, with the exchange committing its own resources to cover the breach.
That commitment puts the financial burden on the company. Customers would otherwise face the prospect of an account shortfall alongside the interruption in access. Replenishment, if completed as promised, would remove that shortfall without requiring every stolen asset to be recovered first.
The pledge also creates a funding task separate from tracking the attacker. Buying replacement assets requires the exchange to deploy resources while the investigation and recovery effort proceed. Customers would therefore have a route to reimbursement that does not depend entirely on the attacker returning funds.
Reported loss figures differ. CoinDesk reported on November 3 that Mercado Bitcoin put losses at about $38 million, while Cointelegraph cited analysts estimating more than $46 million. Bitquery's investigation, with figures verified November 4, calculated $48.6 million across 10 blockchains. The final loss figure remains unsettled.
The reported freeze totals also differ: Mercado Bitcoin told Cointelegraph that more than $15 million had been frozen, while Bitquery counted $11.8 million. Frozen funds are not money already returned to customers.
Deposit addresses make the security checks consequential
Bitquery's investigation found that the attacker reached both hot wallets and customer deposit addresses. It counted 36,042 Ethereum deposit addresses emptied and said transfers continued for about four hours after the exchange announced containment.
Those findings give the independent testing requirement a concrete purpose. The recovery involves the systems that can authorize movements from exchange-controlled addresses, including addresses customers previously used to deposit funds.
Bitquery explains that the exchange holds the private keys for these deposit addresses and its hot wallets. A customer-specific deposit address therefore remains part of the exchange's custody arrangement. The address can identify an account without giving that customer exclusive control over the assets sent there.
The incident exposes customers' dependence on the exchange's signing systems, its response to a compromise and its capacity to replace missing assets. Reimbursement would cover the financial consequence; security testing addresses the transaction systems before they return to use. Both are necessary to the promised recovery, but they serve different purposes.
For readers comparing that arrangement with holding their own wallet keys, the relevant difference is who authorizes transfers. Here, customers must wait for Mercado Bitcoin to restore those functions even after account viewing becomes available.
Overview
Mercado Bitcoin has announced a phased recovery after a breach with differing loss estimates, including the more than $46 million figure cited by Cointelegraph. The exchange promises to replace affected assets using company funds and says its trading desk is preparing repurchases.
The plan gives customers an initial date for reviewing their accounts while keeping asset movements subject to independent security testing. Monday's first phase covers website access to balances, statements, holdings and investments. Transfers, withdrawals and trading follow in later phases.
