Mercado Bitcoin Starts Gradual Platform Restoration After Hack, Withdrawal Timeline Remains Unclear
Users regain ability to check pre-attack account balances during phased restoration process. Platform operators have not provided specific date for withdrawal functionality to return.
On Monday, cryptocurrency platform Mercado Bitcoin initiated a phased restoration of view-only account access for its users, seven days following a security breach that resulted in the theft of approximately $49 million from the exchange. The platform has not yet provided information regarding when withdrawal capabilities will become available again.
According to a representative from Mercado Bitcoin speaking with Cointelegraph, the restoration process would commence at 19:00 UTC, with full account visibility anticipated to be completed by 21:00 UTC. Users will have the capability to view their asset balances as they existed on Nov. 2, when the security incident occurred.
Through a video message shared on the exchange's X social media profile, Fabricio Tota, who serves as vice president of new business, stated that Mercado Bitcoin's intention with restoring read-only access was to provide customers with confidence that their digital assets remained documented within the platform's systems.
As one of the leading cryptocurrency exchanges operating in Brazil, Mercado Bitcoin disclosed to Brazilian publication Veja during late October that its user base exceeded 4.8 million customers and that the platform had facilitated transactions totaling more than 215 billion Brazilian reais ($39 billion) throughout its operational history. While the exchange has committed to utilizing its own capital reserves to compensate for the assets taken during the breach, no specific timeline has been announced for when withdrawal services will be reinstated.
"A more conservative approach"
In his explanation, Tota stated that the organization chose to implement "a more conservative approach" when reactivating user accounts "to ensure our return happens with the utmost security." This cautious methodology comes in response to apprehensions raised by blockchain security experts who noted that the perpetrators appeared to have gained access to private keys, allowing them to drain wallets through normal transaction processes rather than exploiting vulnerabilities in smart contract code.
Security researchers analyzing blockchain data discovered that portions of the misappropriated funds were directed to customer deposit addresses, though Mercado Bitcoin has assured users they will not be held responsible for any financial losses. "The vast majority of assets, in fact, nearly all of them, were never even touched by anyone; they were not even involved in the incident," Tota emphasized during his video statement.
During the announcement made on Nov. 4, Mercado Bitcoin made a commitment to reimburse all losses using corporate resources, supported in part by a $20 million capital injection from Tether, the stablecoin issuer, which was secured in July. Tota also pointed out that certain quantities of the stolen cryptocurrency were successfully frozen within hours following the company's public disclosure of the attack.
The road to full recovery
Moving forward, the subsequent stage of the recovery process will mandate that users verify their registration information on the platform before gaining the ability to transfer their assets. The exchange has outlined plans to reestablish withdrawal functionality through Pix, the instant payment infrastructure used throughout Brazil, with initial limitations restricting customers to withdrawing funds exclusively to bank accounts registered under their own legal names. However, Tota did not provide a specific timeframe for implementing either of these steps.
To date, Mercado Bitcoin has not disclosed the specific methods by which the attackers successfully obtained access to its wallet infrastructure. Analysis conducted by Bitquery, a blockchain data analytics firm, revealed that as of Nov. 4, digital wallets identified as belonging to the attacker still contained the majority of stolen assets that had not been subject to freezing actions, including a total of 106.07 BTC.