Mercado Bitcoin, Brazil's largest cryptocurrency exchange, begins restoring customer access today, a week after a security breach forced it to freeze deposits and withdrawals. The first step is deliberately narrow: customers will be able to see their accounts, but not move anything.

From Monday, November 9, users can log in through the company's website to check balances, account statements, holdings and investments. Trading, transfers, deposits and withdrawals all remain suspended, and the exchange has given no date for their return. Each service will only come back after its systems pass independent security testing, because custody, deposits, trading and balance management run as one connected system.

The attack struck in the early hours of Monday, November 2, when unauthorised transfers drained the exchange's hot wallets, the internet-connected wallets used for day-to-day operations. Blockchain researchers now put the total taken at about $48.6 million across 10 networks, above the roughly $46 million identified in the first hours. Bitquery, the firm that traced the flows, found that the attacker emptied both exchange hot wallets and customer deposit addresses, including 36,042 deposit addresses on Ethereum alone between 12:27 UTC and 16:56 UTC on November 2.

That last detail complicates the exchange's first account of events. Mercado Bitcoin said publicly at 12:56 UTC on November 2 that the incident had been contained, yet the transfers from deposit addresses continued for roughly four more hours. The finding does not prove the attacker kept access to the same systems throughout, but it raises questions about when control was fully recovered.

The company has told customers they will not lose their assets. It says balances remain recorded on the platform and that any affected assets not recovered will be replaced entirely from company funds, so balances become available for trading or withdrawal once the matching service reopens. Its trading desk is preparing to buy back the replacement assets in domestic and international markets.

More than $15 million linked to the attack has now been frozen or blocked with help from industry partners, up from about $11.2 million identified early on. The freezes span several tokens, including about $5.9 million of Tether-issued tokens and $4.3 million of USDC and EURC. A frozen token cannot be moved by the attacker, but a freeze is not the same as a recovery, and returning the funds can depend on legal and issuer procedures.

Mercado Bitcoin says the majority of customer holdings, kept in offline cold wallets, were not affected, and it has pointed to a $20 million strategic investment from Tether as evidence of a strong cash position. It has not disclosed the size of its liquid corporate reserves, the expected cost of replacing all the affected assets, or how quickly frozen tokens could be returned. Those figures will matter in judging the real financial cost of its pledge to make customers whole.

The exchange has warned users to rely only on its official channels for account actions and to ignore unsolicited requests for passwords, verification codes or deposits. Future updates on the phased return of services will come through those channels.

The incident follows a run of unusually large exchange-security losses, most notably the recent attack on Binance, in which unauthorised transfers ultimately reached billions of dollars before the exchange committed company and reserve funds to cover customers. Read-only access is a transparency milestone for Mercado Bitcoin, not a return to normal: the consequential tests are still ahead, when withdrawals and trading reopen, replacement wallet infrastructure clears independent testing, and customers can see their balances fully restored.