#198: $179 Million Drained in Brazil's Largest-Ever Financial Hack
Plus: Tether looks to mine bitcoin in Brazil; Mercado Bitcoin and Ripple partner on tokenized assets
Olá pessoal!
Welcome back to Brazil Crypto Report for the week of June 30 - July 11, 2025.
I hope everyone is having a restful July. I was off the grid last week in Michigan on the South Shore of Lake Superior — one of my all-time favorite places in the US.
Here’s a picture of the sunrise over the lake from my balcony.
Naturally, whenever you’re completely off the grid is when the craziest news always happens. In this case it was the largest financial hack ever seen in Brazil, in which infiltrators bribed an employee of a PIX service provider to hand over his login credentials. We’ll get into the details of all that below.
In the meantime, be sure to check out Blockchain Rio which is happening August 5-7 at ExpoMag in Rio de Janeiro. BCR is excited to be an ecosystem partner for this year’s event once again.
Also, please jump into the BCR English language Telegram group if you’d like to continue the conversation
📰 Top Stories this Week
Hackers steal R$1 billion from Central Bank accounts in largest financial hack ever in Brazil
Tether looks to mine bitcoin in Brazil
Mercado Bitcoin to tokenize US$200 million in RWAs on XRPL
Empiricus Asset has launched a bitcoin ETF on the B3 exchange
Thanks for reading and have a great week!
- AWS
🙌 🇧🇷Brazil Crypto Report is a free publication; if you wish to support my work you can do so by hitting the button below👇
Brazil Crypto Report is presented by
Avenia is the programmable financial infrastructure for Latin America. Connect to local payment rails like PIX, SPEI and CBU — using stablecoins as settlement — and unlock real-time, cross-border payments without banks, FX desks, or SWIFT.
Whether you're building a wallet, a crypto card, or a global treasury solution, Avenia gives you the APIs and compliance-ready infrastructure to scale in LatAm. Move money between BRL, USD, MXN and more — fast, transparent, and fully on-chain.
🎙️New Podcasts!
We have two new episodes this week. The first is with Josh Solesbury who is an investor at ParaFi Capital, one of crypto’s largest venture firms. Josh has been doing a ton of research into the stablecoin cross-border payment use case. In this interview, he articulately lays out his investment thesis and why Latin America is the ground zero for this application.
I also talk to Tanssi Foundation CEO Thiago Rudiger about how Tanssi is enabling builders to deploy customized "appchains” in an easy, cheap and secure manner.
🙌 Friendly reminder that you can listen to BCR on your favorite podcast platform YouTube | Spotify | Apple Podcasts
Hackers steal R$1 billion from Central Bank accounts
In what is by far one of the craziest stories in crypto we’ve ever seen, hackers successfully drained R$1 billion (US$179 million) held in Central Bank reserve accounts by compromising a Pix technology vendor called C&M Software, which offers banking-as-a-service.
The funds were diverted from the reserve accounts of at least six financial institutions including BMP, Banco Paulista and Credsystem, making it the largest-ever financial hack in Brazil — according to Sao Paulo Civil Police chief Paulo Barbosa.
The hackers then attempted to convert the stolen funds into USDT and bitcoin using various exchange platforms and OTC desks.
The hackers compromised C&M’s system by paying an employee a US$2,700 bribe to hand over his credentials, which the infiltrators used to gain entry to the central bank reserve accounts of at least six Brazilian financial institutions.
João Nazareno Roque, the C&M employee implicated in the breach, told police he was approached at a bar by a man who knew of his work at C&M and offered to pay him the money in exchange for credentials, according to Globo. Roque then reportedly helped build a system to enable the theft for an additional US$1,800.
Police searched Roque’s home but found no cryptocurrency wallets or devices of his own.
Exit to Crypto
The hackers converted between US$30-$40 million worth of stolen funds into BTC, ETH and USDT, according to ZachXBT — who called it one of the “craziest cases of the year.”
The fraudulent transfers from the reserve accounts went undetected for two and half hours before BMP noticed the suspicious transactions.
SmartPay CEO Rocelo Lopes told Portal do Bitcoin and other outlets that his team began noticing higher than normal transaction volume on the morning of June 30, and that the actions of the participants indicated a high level of savviness and skill:
"The hacker transferred funds to several frontmen, who then sent small amounts to OTC desks, which then ended up in other, larger OTC desks with which they already had a relationship.”
Livecoins reports that several P2P operators began receiving “strange” offers from new customers beginning Saturday June 30 when the hack took place. These new customers offered to pay a very high 5% brokerage fee to buy crypto with fiat reals.
Many P2P sellers began refusing to service new clients to avoid becoming entangled in the situation. One of them told Livecoins:
"I've never had a problem with bitcoin sales since I've been in the market for seven years, and a friend of mine received an offer from a new client who wanted to buy R$50 million out of the blue. I alerted him to the hacker attack on the central bank, and he stopped responding to the client's request to protect himself.”
Valor reported that five of the largest exchanges in Brazil saw BRL/USDT trading volumes more than double their daily average for June.
Repercussions
Local courts have frozen destination accounts allegedly used by the hackers. Sao Paulo Civil Police chief Renato Topan said in a press conference that R$15 million in crypto from the hack was frozen, though he didn’t specify which cryptos or whether the freeze was carried out on a brokerage or a self-custodial solution.
BMP, a financial institution which lost around $73.8 million has recovered about one-third of that total, CEO Carlos Benitez told NeoFeed.
Ronaldo Sayeg, director of the State Department of Criminal Investigations, said that exact motives and facts of the case are still unclear:
“For now, we only have the prisoner's version of events; he was lured by a job offer and claims he didn't know what was going to happen. The fact is that he, either tricked or coerced, facilitated access to the franchise for these outsiders,"
The Central Bank suspended three other Pix institutions suspected of receiving stolen funds linked to the attack: Transfeera, Soffy and Nuoro Pay. The authority plans to investigate whether these entities are linked to the breach.
The Block CoinDesk Valor Associated Press Exame
Tether looks to mine bitcoin in Brazil
The USDT issuer announced on July 3 that it will explore a strategic collaboration focused on bitcoin mining in Brazil with agribusiness giant Adecoagro.
Recall that Tether has a 70% ownership stake in Adecoagro, which operates in Brazil, Argentina and Uruguay.
In a statement, Tether described the partnership as a “joint project that combines renewable energy and digital assets.” It added:
"As the world adopts cleaner energy systems, Bitcoin mining is gaining ground as a way to monetize surplus energy, stabilize power grids, and boost the digital economy."
Notably, Adecoagro has over 230 MW of renewable energy capacity in South America.
Mariano Bosch, co-founder and CEO of Adecoagro, said:
"This project opens the door to stabilizing a portion of the energy we currently sell on the spot market, locking in pricing, while also gaining exposure to the upside potential of bitcoin.”
Portal do Bitcoin CoinDesk Livecoins The Block
Mercado Bitcoin to tokenize US$200 million in RWAs on XRPL
Mercado Bitcoin announced that it is tokenizing US$200 million worth of real-world assets on Ripple’s XRP Ledger.
The tokenized assets will include fixed-income and equity financial instruments.
The partnership marks one of the largest tokenization efforts ever undertaken by a Latin American financial institution, as well as a strategic expansion for MB as it looks to expand its offerings to other South American and European markets.
Fabricio Tota, MB’s director of new business, said in a statement:
"Ripple is one of the biggest global references in blockchain infrastructure for institutions, and having MB as our first partner in Brazil reinforces the solidity of what we have built so far. This collaboration boosts our international presence and connects our tokenized assets to a network with scale, liquidity, and global recognition.”
Silvio Pegado, Ripple’s managing director for Latin America, said:
"Mercado Bitcoin's integration with the XRPL demonstrates how public blockchain infrastructure is gaining institutional trust and becoming a solid foundation for bringing regulated financial products to market.”
Bloomberg Linea CoinTelegraph Brasil Portal do Bitcoin Livecoins BlockNews
🗞Brazil Crypto News Rundown
📈 Markets
Empiricus Asset has launched a bitcoin ETF that tracks the Teva Bitcoin Index. The product now trades on the B3 exchange under the ticker EBIT11. Joao Piccioni, CIO of Empiricus Asset, argued that bitcoin is becoming an important diversification play for investors’ portfolios, especially with its volatility in decline:
"Even at its worst in April, bitcoin recovered quickly and without the runaway that would occur during other times of market stress." (Valor) (Portal do Bitcoin) (CoinTelegraph Brasil)
Ambipar is partnering with B3 Digitas, the digital assets arm of the B3 stock exchange, to trade tokenized carbon credits. (Valor)
Trading volumes on Brazilian exchanges more than doubled this week as bitcoin hit new all-time highs. (Livecoins)
Bybit’s Brazil country manager Israel Buzaym spoke to the exchange’s plans to become a regulated player in the market and that Brazil is a critical market for the Dubai-based exchange:
"We've been changing some products for two years now and no longer offering them to comply with local regulations. We want to compete fairly.
"We've expanded content and support in Portuguese on our platforms. From day one, one of my concerns has been how to better serve Brazilians. We're striving to optimize this, as Brazil is strategic." (Valor)
Asset managers in Faria Lima and Leblon are increasingly looking to crypto assets as a diversification tool for client portfolios. (Valor)
Several Brazilian teams participating in the FIFA Club World Cup tournament have fan tokens that are among the world’s largest by market capitalization — namely Flamengo, Fluminense and Palmeiras. (Valor) (Livecoins)
Brazil moved R$9.6 million (US$1.7 billion) in stablecoins during the month of June, according to data from Biscoint. (CoinTelegraph Brasil) (InfoMoney)
📲 Adoption
Interest in tokenized real estate is picking up in Brazil despite a lack of legal clarity around this activity. (Valor)
Livecoins interviewed a Brazilian YouTuber who lives in the forest in Rio Grande do Sul and accumulates bitcoin.
Roberto Campos Neto, former president of the Brazilian Central Bank, began his new role as VP and global head of public policy at Nubank. (Valor)
Nubank has also hired Otavio Damaso, previously the director of regulation at Brazil’s Central Bank. He will serve as advisor for regulatory and risk-management affairs.
Polygon has hired Thamilla Talarico as its director of on-chain finance growth in Brazil. (Valor)
Caixa and Banco do Brasil completed a tokenized property sale on the Drex testnet, handling payment, delivery and credits from different financial institutions via the network. (Valor)
The BRICS Summit participants released a joint statement in defense of open-source artificial intelligence with regard to global technology sharing, governance, risks, and rights protection. (CoinTelegraph Brasil)
🏛 Policy, Regulation and Enforcement
A federal court reduced the sentences of three partners of Fiji Solutions, which is under investigation for operating a bitcoin pyramid scheme similar to that of its rival Braiscompany. (Portal do Bitcoin)
One man died and another was arrested after attempting to kidnap the individual known as Buenos Aires, a businessman from Paraiba behind the Fiji Solutions enterprise. (Livecoins)
The final communique released July 6 after the BRICS Rio summit includes a mention of cryptocurrencies in the context of combating organized crime. It reads:
"We reiterate our commitment to preventing and combating illicit financial flows (...) and the use of new technologies, including cryptocurrencies, for illegal purposes, particularly terrorist ones.” (Portal do Bitcoin)
A Brazilian woman lost R$271,000 in crypto after the exchange she invested in froze her ability to withdraw funds. (Portal do Bitcoin)
A simulation run by the CVM found that half of Brazilian participants were willing to put money into an investment scheme that showed clear signs of being a fake cryptocurrency exchange. (Livecoins)
The city of Rio de Janeiro is investing in a film about the story of Glaidson Acacio dos Santos, aka the “Pharaoh of Bitcoins”. (Livecoins)
Alexandre Senra of the Federal Public Prosecutor’s Office offered five tips for how to avoid falling into cryptocurrency scams. (Valor)
Curitiba-based Fanini Invest may be the latest crypto pyramid scheme to collapse after raising R$180 million from investors who were promised 30% monthly returns. (Livecoins)
Civil Police in Goias and Rio de Janeiro arrested a couple accused of purchasing banking data on the dark web with cryptocurrencies. The action against the criminal group has frozen R$112 million in assets. (Portal do Bitcoin) (CoinTelegraph Brasil)
The Brazilian government’s approach to regulating crypto is solely focused on taxation, argues Andreoni Camargo in a Livecoins op-ed
Police in Guaruja are investigating a theft case involving a 51 year-old woman who claims to have been robbed via a love scam by a man who presented himself as a “bitcoin master”. (Portal do Bitcoin) (CoinTelegraph Brasil)