Brazilian cryptocurrency exchange Mercado Bitcoin has begun a phased reopening of its platform, one week after a massive security breach forced the exchange offline on Nov. 2. Account holders can now check their balances and investment positions, but deposits, withdrawals, transfers and trading all remain suspended while the exchange conducts security checks. The company has not stated a specific time for when full access to withdrawals will be restored.

In light of the Nov. 2 security breach and hack, Mercado Bitcoin has launched an ongoing process of restoring access to view-only accounts, which it described as the first phase of its recovery plan.

Phased Return of Account Access

On Nov. 9, Mercado Bitcoin resumed the operation of its websites, allowing users to view their account balances, transaction history, investments and portfolio details. Crypto trading, transfers and withdrawals will only resume after individual platform modules successfully complete final security validation, with further services to be brought back progressively as each module clears validation. The sequencing places viewing ahead of transacting, letting customers first confirm what they hold while the systems that move funds are still being revalidated.

The company announced the restart of operations in a post on X:

Início da retomada gradual e consulta de saldos, com Fabrício Tota, VP de Novos Negócios do Mercado Bitcoin — Mercado Bitcoin (@MercadoBitcoin) November 9, 2026

https://x.com/MercadoBitcoin/status/2119782411093618923?ref_src=twsrc%5Etfw

The balances presented during the initial reopening are customer balances as of the day the platform was shut down. Mercado Bitcoin has also stated that no losses from the incident will be borne by clients, and that the company intends to replace the affected assets with its own means, with financing arrangements still being worked out. That arrangement puts the financial cost of the breach on the exchange itself rather than on account holders, though the funding behind the pledge has yet to be finalized.

$49M Moved Across 17 Blockchains

Blockchain analytics firm Chainalysis estimates that attackers moved approximately $49 million in cryptocurrencies during the Nov. 2 attack, with the funds withdrawn across as many as 17 different blockchains. The funds moved both on individual networks and between them. Bitcoin and Ether were the most stolen currencies, with funds also sent to networks including Base, Tron and Polygon. Spreading the proceeds across that many networks means tracing work has to follow flows both within and between blockchains.

Chainalysis said it has been collaborating with Mercado Bitcoin, law enforcement and industry partners to trace the stolen funds, and that almost $10 million was frozen from the start of the response effort. Shortly after that assessment, Mercado Bitcoin disclosed that an estimated $11 million of the stolen funds had been frozen, while an estimated $38 million had not been frozen — up from the nearly $10 million Chainalysis reported earlier, though most of the stolen funds remain outside frozen controls.

Withdrawals Remain the Key Missing Feature

For users, the primary unresolved issue is when they will regain full control of their assets. Recovery of deposits, withdrawals and trading on Mercado Bitcoin is currently on hold, and the exchange's service status page continues to display a message indicating that deposits and withdrawals are not available while security checks continue.

Before transaction functions return, customers are expected to complete account-verification steps and reactivate their credentials through Mercado Bitcoin's official communication channels. Only after these steps are completed will users be able to move funds again.

The company has stated that it will slowly resume payments and trading in subsequent stages and will not reopen everything at once. It described this as a conservative rollout, based on the nature of the incident. According to Mercado Bitcoin, most customer assets are held in cold wallets, and the breach affected online hot wallets. Hot wallets are internet-connected accounts used for day-to-day transaction processing, while cold wallets are kept offline — an industry-standard arrangement designed to limit how much can be reached if online systems are compromised.

The milestones to watch as the recovery continues are module-by-module security validation results, status-page updates as each service clears its checks, and details on the financing arrangements the company says remain in progress. With view-only access now being restored, combining it with the return of withdrawals and cryptocurrency transfers will be an important step toward the platform's full recovery.