Crypto exchange Mercado Bitcoin began restoring read-only access to customer accounts in phases on Monday, one week after attackers drained an estimated $49 million from the platform. The exchange has yet to say when customers will be able to withdraw their funds.

A Mercado Bitcoin spokesperson told Cointelegraph that access would begin at 19:00 UTC, with all accounts expected to be viewable by 21:00 UTC. Customers will see their holdings as they stood on Nov. 2, the day of the hack. Read-only access is an interim step: customers can view their balances but cannot move funds until later phases of the recovery.

In a video posted to the exchange's X account, Fabricio Tota, the company's vice president of new business, said Mercado Bitcoin hoped read-only access would reassure customers that their assets were still recorded on the platform.

Mercado Bitcoin, one of Brazil's largest crypto exchanges, told Brazilian magazine Veja in late October that it had more than 4.8 million customers and had processed over 215 billion Brazilian reais ($39 billion) in cumulative transactions. The exchange says it is using its own funds to replace the stolen assets, but has yet to give a date for withdrawals to resume.

“A more conservative approach”

Tota explained that the company opted for “a more conservative approach” to reactivating accounts “to ensure our return happens with the utmost security.” The caution follows concerns from blockchain security analysts that the attackers were able to access addresses, draining funds through standard transfers rather than a smart contract exploit.

Blockchain analysts traced some of the stolen funds to customer deposit addresses, but Mercado Bitcoin says customers will not bear the losses. “The vast majority of assets, in fact, nearly all of them, were never even touched by anyone; they were not even involved in the incident,” Tota said in the video.

On Nov. 4, Mercado Bitcoin pledged to cover all losses with company funds, bolstered by a $20 million investment from stablecoin issuer Tether in July. Tota highlighted that a portion of the stolen funds was also frozen in the hours after the company announced that an attack had taken place.

The road to full recovery

The next phase of recovery will require users to confirm their registration details on the platform before they can move funds. The exchange plans to restore withdrawals via Pix, Brazil's instant payment system, initially allowing customers to withdraw only to accounts in their own name. Tota gave no date for either step.

Mercado Bitcoin has yet to explain how the attackers gained access to its wallets. Blockchain data company Bitquery found that, as of Nov. 4, wallets it linked to the attacker held most of the stolen funds that had escaped freezes, including 106.07 BTC.

With no dates announced for those steps and no explanation yet of how the attacker reached the exchange's wallets, those open items are the milestones to watch as the recovery proceeds.

Magazine: Vitalik 'pivots' ETH to store of value, crypto suffers after US midterms: Hodler's Digest