By Brazilian cryptocurrency exchange Mercado Bitcoin will begin restoring customer access on November 9 after a security breach that blockchain researchers now estimate drained about $48.6 million across 10 networks.
The first phase will provide read-only access through Mercado Bitcoin’s website, allowing customers to check balances, statements, holdings and investments. Trading, transfers and withdrawals will remain unavailable until later stages and will only return after independent security testing, according to the exchange.
Mercado Bitcoin has also pledged to replenish affected assets with company funds and said its trading desk is preparing repurchases in domestic and international markets. More than $15 million linked to the attack has now been frozen or otherwise blocked with assistance from stablecoin issuers and blockchain investigators.
How Much Was Actually Taken From Mercado Bitcoin?
The latest blockchain analysis puts the value of assets removed from Mercado Bitcoin-linked wallets at about $48.6 million, above the roughly $46 million identified during the first hours of the incident.
Bitquery traced unauthorized transfers across 10 blockchains and found that the attacker drained both exchange hot wallets and customer deposit addresses. On Ethereum alone, 36,042 deposit addresses were emptied between 12:27 UTC and 16:56 UTC on November 2.
That activity continued for roughly four hours after Mercado Bitcoin publicly said at 12:56 UTC that the incident had been contained. The finding does not necessarily mean the attacker retained access to the same system throughout that period, but it complicates the initial timeline and raises questions about when control over all affected wallet infrastructure was actually removed.
FinanceFeeds’ initial analysis of the Mercado Bitcoin breach documented outflows from hot wallets across multiple networks and early freezes by Tether and Circle. The higher estimate reflects additional tracing conducted after those first disclosures.
Investor Takeaway
The final loss cannot be measured simply by the value that originally left the wallets. Frozen assets, recoveries and the cost of repurchasing stolen tokens will determine the exchange’s ultimate financial hit, while the continued post-disclosure transfers make the technical timeline an important part of the investigation.
How Much of the Stolen Crypto Has Been Frozen?
Mercado Bitcoin says more than $15 million has been blocked with assistance from industry participants. Separate tracing shows interventions by Tether, Circle, Paxos, Ripple, Agora and other projects.
Chainalysis said it coordinated with law enforcement and token issuers shortly after being notified of the attack. Its investigators initially helped freeze nearly $10 million, including more than $9 million in USDT through coordination with Tether.
Bitquery’s later accounting identified freezes across several assets and networks, including approximately $5.9 million of Tether-issued tokens, $4.3 million of USDC and EURC and about $1.5 million of Paxos-issued assets. Other issuers also restricted smaller balances.
These assets should not automatically be counted as recovered cash. A freeze prevents designated tokens from moving, but their eventual return can depend on legal, technical and issuer procedures.
The response resembles the much larger intervention following the recent Binance breach, where Tether, Circle and Ripple froze billions of dollars in issuer-controlled tokens. Bitcoin, Ether and many other crypto assets do not offer an equivalent issuer-controlled mechanism.
Investor Takeaway
Roughly a quarter of the Mercado Bitcoin outflows appear to have been immobilized through token-level controls. The remaining exposure is harder to recover because much of it sits in assets whose networks do not permit an issuer to blacklist an attacker-controlled wallet.
Why Is Mercado Bitcoin Repurchasing Assets?
The exchange has said customers will not bear losses from the incident. To meet that commitment, Mercado Bitcoin plans to use its own resources to replace affected assets rather than waiting for every stolen token to be recovered.
“Our trading desk is preparing to begin the necessary repurchases in domestic and international markets,” the company said.
The repurchase process matters because customers may have claims denominated in specific cryptocurrencies rather than in their dollar value at the time of the attack. Restoring those balances can therefore require Mercado Bitcoin to buy replacement assets at prevailing market prices.
The exchange said it has a strong cash position and pointed to a $20 million strategic investment from Tether that was intended to support its broader operational expansion. That investment should not be confused with compensation specifically provided for the hack.
Mercado Bitcoin has not disclosed the size of its liquid corporate reserves, the expected cost of replacing all affected assets or how quickly frozen tokens could be returned. Those figures will be important in assessing the financial impact of its customer-reimbursement commitment.
What Happens When Mercado Bitcoin Reopens?
November 9 will not mark a return to normal trading. Customers will initially receive access only to account information, while transactions remain disabled.
Mercado Bitcoin says transfers, withdrawals and trading will return through subsequent phases after external security validation. It has not provided a date for those functions to resume.
The cautious sequence is significant because blockchain researchers found that old customer deposit addresses were among those swept during the attack. Deposits therefore cannot safely resume until Mercado Bitcoin is confident that affected wallet infrastructure has been replaced or secured and customers are given valid deposit destinations.
The incident follows a period of unusually large exchange-security losses. In the recent Binance attack, unauthorized transfers ultimately reached billions of dollars before the exchange committed company and reserve funds to cover customers, putting renewed attention on how centralized platforms manage hot-wallet exposure and recovery liquidity.
Investor Takeaway
Read-only access is primarily a transparency milestone, not a liquidity restoration. The more consequential checkpoints will be the return of withdrawals and trading, confirmation that replacement wallet infrastructure has passed independent testing and evidence that customer balances have been fully replenished.