{"id":860281,"date":"2025-07-05T19:11:59","date_gmt":"2025-07-06T00:11:59","guid":{"rendered":"https:\/\/newsycanuse.com\/index.php\/2025\/07\/05\/hackers-steal-140m-from-brazilian-central-bank-reserve-accounts-via-partner-breach\/"},"modified":"2025-07-05T19:11:59","modified_gmt":"2025-07-06T00:11:59","slug":"hackers-steal-140m-from-brazilian-central-bank-reserve-accounts-via-partner-breach","status":"publish","type":"post","link":"https:\/\/newsycanuse.com\/index.php\/2025\/07\/05\/hackers-steal-140m-from-brazilian-central-bank-reserve-accounts-via-partner-breach\/","title":{"rendered":"Hackers steal $140M from Brazilian central bank reserve accounts via partner breach"},"content":{"rendered":"
\n

\"Hackers Hackers steal $140M from Brazilian central bank reserve accounts via partner breach<\/span> Gino Matos \u00b7<\/span> 20 hours ago<\/span> \u00b7 2 min read<\/span> <\/span> <\/span> <\/span> <\/span><\/p>\n

\n
\n

According to sources who prefer to remain anonymous, the hackers are having issues to buy crypto via Brazilian OTC desks.<\/p>\n

\n
\n

<\/a><\/p>\n<\/div>\n

\n

2 min read<\/span><\/p>\n

Updated:<\/span> Jul. 5, 2025 at 1:55 pm UTC<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n

\n

\"Hackers<\/p>\n

Cover art\/illustration via CryptoSlate. Image includes combined content which may include AI-generated content.<\/p>\n<\/div>\n<\/div>\n

\n
\n

\"Nemo\" <\/a><\/p>\n<\/div>\n

Hackers siphoned about R$800 million ($140 million) from six reserve accounts connected to Brazil\u2019s central bank after breaching S\u00e3o Paulo-based software vendor C&M Software on June 30, according<\/a> to blockchain investigator ZachXBT<\/a> and reports from local news outlets.<\/span><\/p>\n

Police said C&M employee Jo\u00e3o Nazareno Roque sold his corporate login for R$15,000 ($2,770) and later developed a secondary access tool for an additional R$10,000 ($1,850), giving attackers direct access to the vendor\u2019s infrastructure.<\/span><\/p>\n

Investigators traced unauthorized instructions that moved funds from the reserve accounts held at the Central Bank of Brazil for interbank settlement into commercial bank accounts tied to over-the-counter (OTC) desks and regional exchanges.<\/p>\n

ZachXBT estimated that between $30 million and $40 million of the stolen funds had already been swapped for major digital assets, including Bitcoin<\/a>, Ethereum<\/a>, and USDT<\/a>.\u00a0<\/span><\/p>\n

On-chain analysis teams and Brazilian prosecutors are coordinating wallet freezes while attribution work continues.<\/span><\/p>\n

Central bank and vendor response<\/strong><\/h2>\n

The central bank ordered all institutions that routed through C&M to disconnect immediately after the breach and cleared the firm to restore service two days later, stating that critical systems remained intact.<\/span><\/p>\n

C&M commercial director Kamal Zogheib told Reuters that the attack relied on fraudulent client credentials rather than a code flaw and confirmed cooperation with the Federal Police and S\u00e3o Paulo investigators.<\/span><\/p>\n

BMP, a banking platform provider hit in the raid, told local media that only its reserve balance was affected, and customer deposits remained untouched.<\/span><\/p>\n

Law enforcement officials have frozen R$270 million ($49.8 million) while tracking additional flows and searching for at least four accomplices cited in preliminary warrants.<\/span><\/p>\n

Roque remained in custody in S\u00e3o Paulo as of July 3. Police allege that he rotated his mobile phones every two weeks to avoid being monitored.<\/span><\/p>\n

Laundering route through Latin America<\/strong><\/h2>\n

Transaction records reviewed by ZachXBT and independent researchers indicate that the attackers structured transfers across multiple exchanges in Brazil, Argentina, and Paraguay, then utilized OTC brokers to settle into crypto within three hours of the initial breach.<\/span><\/p>\n

Sources who prefer to remain anonymous told CryptoSlate<\/em> that the attackers found it challenging to buy crypto with the stolen money in Brazilian OTC desks, as most of the largest ones raised red flags due to the large amounts.<\/span><\/p>\n

Brazil\u2019s Federal Police declined to specify which platforms processed the swaps but said exchange operators have begun freezing balances tied to flagged addresses.<\/span><\/p>\n

The central bank has not disclosed whether additional vendors will face new connection requirements but signaled that the instant payment rail PIX and reserve account interfaces may receive further controls.<\/span><\/p>\n

The probe continues under federal supervision, with investigators prioritizing the recovery of funds and identifying the remaining organizers.<\/span><\/p>\n

Mentioned in this article<\/h6>\n
\n
Latest Brazil<\/span> Stories<\/h5>\n<\/div>\n
\n
\n
Press Releases<\/h5>\n<\/header>\n<\/div>\n<\/div>\n<\/div>\n

Read More<\/a>
\n Gino Matos<\/p>\n","protected":false},"excerpt":{"rendered":"

Hackers steal $140M from Brazilian central bank reserve accounts via partner breach Gino Matos \u00b7 20 hours ago \u00b7 2 min read According to sources who prefer to remain anonymous, the hackers are having issues to buy crypto via Brazilian OTC desks. 2 min read Updated: Jul. 5, 2025 at 1:55 pm UTC Cover art\/illustration<\/p>\n","protected":false},"author":1,"featured_media":860282,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[183,3066],"tags":[],"class_list":["post-860281","post","type-post","status-publish","format-standard","has-post-thumbnail","category-hackers","category-steal"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts\/860281","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/comments?post=860281"}],"version-history":[{"count":0,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts\/860281\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/media\/860282"}],"wp:attachment":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/media?parent=860281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/categories?post=860281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/tags?post=860281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}