Mercado Bitcoin to Resume Pix Cash Withdrawals Next Week After $49M Hack, Crypto Still Frozen

Published November 11, 2026, 1:15 AM PKT. Based on Cointelegraph's report of November 10, 2026 (primary source, a Mercado Bitcoin representative), CryptoBreaking's report of November 10, 2026, and KuCoin's flash reports of November 9, 2026 (secondary sources).

Mercado Bitcoin will resume deposits and withdrawals in Brazilian reais through Pix next week, a company representative told Cointelegraph on November 10, 2026, more than 15 days after an attack drained an estimated $49 million from wallets linked to the exchange. It is the first calendar date the exchange has attached to any money leaving the platform since the November 2 incident, and it answers the question its roughly 4.8 million customers have been asking for eight days: when they can get cash out.

The restart covers fiat only. Crypto deposits and withdrawals remain suspended, with no date set for their return, and trading and transfers stay shut. The exchange began restoring access on Monday, November 9, by letting customers view their accounts in read-only mode, and the Pix phase is the next step in that staged return.

Cash first, crypto still frozen

Pix is Brazil's instant payment system, run by the country's central bank, and it moves reais between bank accounts around the clock. Mercado Bitcoin will reopen both deposits and withdrawals through Pix next week, the representative told Cointelegraph, but the exchange has not named a day, and it has not published a rollout schedule on its website. Fabricio Tota, the exchange's vice president of new business, outlined the next phase in a recent video, according to Cointelegraph.

"The resumption will proceed gradually, and the rollout of additional services will be communicated to clients in advance through MB's official channels," the representative said. The exchange will also credit customers' accounts with proceeds from the settlement of fixed income products, Cointelegraph reported, which gives customers with those holdings something to withdraw once Pix reopens.

What does not return next week is everything on-chain. Crypto deposits and withdrawals, transfers and trading remain suspended, and the exchange has given no date for any of them. Customers who hold only crypto will still be able to look at their balances and do nothing else.

Own-name accounts and new passwords

The Pix return comes with two conditions. Withdrawals will go only to bank accounts held in the customer's own name, the representative told Cointelegraph, and before moving any money, every customer must re-confirm their registration details and set a new password in the Mercado Bitcoin app, according to KuCoin's November 9 flash report on the exchange's recovery plan.

The conditions are a direct response to how the attack worked. Blockchain security analysts found the attackers reached customer deposit addresses and drained funds through standard transfers rather than a smart contract exploit, Cointelegraph reported, which is why the exchange is treating re-verified identities and fresh credentials as a precondition for letting money move again.

The sequencing also explains the order of the phases. Balance viewing came first because it touches nothing, Pix comes second because it moves fiat through bank accounts the exchange can verify, and crypto transfers come last because they move assets the exchange cannot recall once sent. Each later function opens only after its own module clears security checks, the exchange has said since the start of the recovery.

The November 2 attack, in numbers

The attack drained an estimated $49 million from wallets linked to the exchange across 17 blockchains, according to Chainalysis. The exchange said more than $15 million in stolen assets had been frozen with help from industry participants, including stablecoin issuers Tether ($USDT) and USD Coin ($USDC), and Tota later put the sum still in the attacker's hands at about $33 million, or about 3% of the assets in the exchange's custody. The exchange keeps about 5% of assets in hot wallets, Tota said.

The on-chain record shows the drain started early. Bitquery, a blockchain analytics firm, said the exchange's Ethereum ($ETH) hot wallet was drained starting at 1:24 a.m. ET on November 2, and the exchange said at 7:56 a.m. ET that the incident was contained. Sweeps of customer deposit addresses ran from 7:27 a.m. to 11:56 a.m. ET, starting about 29 minutes before that statement and continuing for about four hours after it, according to Bitquery. The sweeps emptied 36,042 Ethereum ($ETH) customer deposit addresses holding roughly $266,000 in total, and about 91% of the sampled addresses held under $10.

Mercado Bitcoin told Brazilian magazine Veja in late October that it had more than 4.8 million customers and had processed over 215 billion reais, about $39 billion, in cumulative transactions, Cointelegraph reported. The exchange has said it will use its own funds to replace the stolen assets and that customers will receive their pre-incident balances.

A week of view-only access

The Pix announcement follows a week in which customers could see their money but not touch it. On Monday, November 9, the exchange began restoring access in phases, starting at 19:00 UTC, with all accounts expected to be viewable by 21:00 UTC, a spokesperson told Cointelegraph. Customers can see their holdings as they stood on November 2, the day of the hack, and unfilled limit orders were canceled when the platform shut down.

A view-only balance is a ledger entry on a custodial exchange, not evidence that matching assets sit in reserve. The exchange says customer balance records were unaffected by the incident and that later phases follow independent security testing, and none of the reports reviewed describes an independent proof-of-reserves audit. The exchange has also not explained how the attackers gained access to its wallets.

The November 2 attack came four days after hackers stole about $6.3 billion in crypto from Binance's hot wallets in a separate breach, which the FBI attributed to North Korean hackers. BitMart founder Sheldon Xia confirmed in a November 3 post on X that his exchange was also hacked on November 2, said the amount was small, and said BitMart's initial review suggests the same group is responsible.

What is still missing

Three things remain unanswered. The first is a date for crypto withdrawals, transfers and trading, which the exchange has tied to security checks rather than a calendar. The second is how the attackers got in, which the exchange has not explained eight days after the incident. The third is a published rollout schedule, which the exchange has not posted on its website even as it confirms the next phase to reporters.

Until those land, the practical picture for customers is narrow but real. Next week, a customer who has re-confirmed their details and set a new password in the app will be able to withdraw reais to a bank account in their own name through Pix, and fixed income settlement proceeds will be credited to their account. Everything else stays where it has been since November 2: visible, and frozen.

Sources

• Cointelegraph, Brazil's Mercado Bitcoin to Resume Cash Withdrawals After $49M Hack, published November 10, 2026 (primary source: a Mercado Bitcoin representative told Cointelegraph the exchange will resume deposits and withdrawals in Brazilian reais via Pix next week, more than 15 days after the attack; withdrawals only to accounts in the customer's own name; fixed income settlement proceeds to be credited; crypto deposits and withdrawals remain suspended with no date; Fabricio Tota outlined the next phase in a recent video; no rollout schedule published on the exchange's website; gradual resumption quote)
• CryptoBreaking, Mercado Bitcoin Plans to Restart Cash Withdrawals After $49M Hack, published November 10, 2026 (secondary source: Pix fiat access resumes next week, limited to own-name accounts; crypto deposits and withdrawals stay suspended; rollout gradual with updates through official channels)
• KuCoin, Mercado Bitcoin Resumes Balance Checks and Plans to Restore Fiat Withdrawals Next Week, published November 9, 2026 (secondary source: balance checks resumed November 9, balances shown as of November 2; next phase next week requires customers to re-verify identity and set a new password in the app before accessing funds; Pix withdrawals limited to the user's own named account; trading, crypto lending, staking, bank card transfers and crypto transfers return in later phases)
• Cointelegraph, Mercado Bitcoin Reopens Read-Only Accounts After $49M Hack, published November 9, 2026 (secondary source: read-only access began at 19:00 UTC with all accounts viewable by 21:00 UTC; balances as of November 2; more than 4.8 million customers and over 215 billion reais, about $39 billion, in cumulative transactions per Veja; no date for withdrawals; attackers accessed addresses and drained funds through standard transfers rather than a smart contract exploit)
• TechTimes, Mercado Bitcoin Hack: Withdrawals Stay Shut as View-Only Reopening Shows November 2 Balances, published November 10, 2026 (secondary source: Tota said about $33 million remains with the attacker, about 3% of custody, with about 5% of assets in hot wallets; Bitquery timeline for the Ethereum ($ETH) hot wallet drain and the 36,042 deposit-address sweeps; BitMart founder Sheldon Xia confirmed a November 2 hack on his exchange and said the same group is likely responsible)
• Chainalysis, via CryptoNinjas, Mercado Bitcoin Starts Phased Reopening After $49M Hack, Withdrawals Stay Frozen, published November 10, 2026 (secondary source: attackers withdrew nearly $49 million across as many as 17 blockchains; about $11 million frozen and about $38 million not frozen per the exchange's disclosure)

This article is news reporting and is not investment advice.