Mercado Bitcoin, a leading cryptocurrency exchange in Brazil, has partially reinstated user account access for viewing purposes following a significant security breach. This development comes after a cyberattack resulted in losses nearing $49 million. The exchange announced that while customers could now see their account balances, no timeline has been provided for the resumption of withdrawal functionalities.
Access Implemented in Phases
According to a company spokesperson, by 19:00 UTC on Monday, the platform began restoring access, with all accounts expected to be viewable by 21:00 UTC. Users will be able to check their balances as they stood on November 2, the day when the attack occurred. Mercado Bitcoin’s Vice President, Fabricio Tota, expressed in a video on the firm’s social media account that enabling read-only access is intended to reassure clients about the status of their assets.
Fabricio Tota stated, “We aim to conduct the reactivation process with the highest security standards, ensuring our customers’ assets are visible and secure, albeit temporarily frozen.”
Company Pledges to Absorb the Loss
In late October, Mercado Bitcoin reported to Veja magazine that it serves over 4.8 million clients and has a total transaction volume exceeding 215 billion Brazilian reais, or roughly $39 billion. The company has committed to covering the stolen assets using its resources but has not specified when withdrawals will resume. This assurance places Mercado Bitcoin among the top digital asset exchange platforms in Brazil.
The company’s management clarified that the losses incurred will not be passed onto users. Tota noted that the vast majority of funds remain intact and accessible, emphasizing the company’s commitment to safeguarding customer assets.
Tota emphasized, “The bulk of users’ assets remain unaffected by the breach, and any losses will be absorbed by our company.”
Details of the Attack and Future Steps
Blockchain security analysts revealed that attackers did not exploit smart contract vulnerabilities but rather accessed addresses to initiate standard transfers. Some of the stolen assets were traced back to customer deposit addresses. However, the company reiterated that clients would not bear the losses.
On November 4, Mercado Bitcoin confirmed that all losses would be covered using company funds. This pledge is bolstered by a recent $20 million investment secured from stablecoin issuer Tether in July.
In subsequent steps, users will need to verify their registration information on the platform. Following this, the company plans to re-enable withdrawals via the Pix system, an instant payment system developed by the Central Bank of Brazil. Initially, transfers will be restricted to accounts registered in the user’s name. However, the company has not provided a timeline for these actions.
Mercado Bitcoin has yet to disclose how the attackers gained access to their wallets. Blockchain data firm Bitquery reported that as of November 4, substantial amounts of the stolen, unfrozen assets were traced back to wallets linked to the attackers, including 106.07 BTC.
