Brazil’s Central Bank Probes $140M Crypto Laundering After Hack

In a cyber heist on June 30, hackers stole approximately $140 million (R$800 million) by breaching the reserve account of six Brazilian financial institutions through infrastructure provided by C&M software. The Central Bank of Brazil is actively working to recover the funds after discovering the offender. 

After discovering the theft and the attacker, the central bank immediately issued a notice for a temporary suspension of C&M Software. By Wednesday, the company resumed limited operations under supervision. 

The federal police have opened an investigation at the Cybercrime Repression Department in Brasilia, investigating stolen funds and preventing further laundering in the chain. Currently, the police are investigating a series of questions about those responsible for the hacker attack, and other beneficiaries of the scam are being investigated. 

Discovery of Brazil’s Cyber Theft of $140 Million 

Approximately $140 million was theft by hacking C&M software, the service provider that connects Brazil’s central bank to local banks and other financial institutions. At least $30 to $40 million of the stolen funds were converted into cryptocurrencies, including Bitcoin, Ethereum, and Tether. 

This conversation of fiat money into crypto was carried out via Latin American over-the-counter (OTC) brokers and crypto exchanges. Brazilian officers suspected a laundering route tied to Brazil’s PIX payments infrastructure (a system developed by the central bank to enable instant payments). 

• Also Read :
•   Crypto Hacks in H1 2025 Exceed $2.2B 
•   ,

The Grand Theft Stemming from Internal Compromise

Brazilian law enforcement confirmed that the breach stemmed from an internal compromise. João Nazareno Roque, a software employee at C&M, admitted to selling corporate private credentials to one of the attackers for R$5,000. 

The initial contact between the attacker and Roque occurred in March, when the suspect showed detailed knowledge of Roque’s job. Later, the employee was paid extra R$10,000 to execute the grand theft commands inside the system.  

Final Thought 

The incident of $140 million theft has triggered broad discussion on fintech cybersecurity, third-party provider risks, and regulatory oversight. While the case remains under investigation, Brazilian officials are targeting to end these cybercrimes altogether.

FAQs