Cyber Heist: Hackers Steal $140M From Brazilian Central Bank Funds
By: Eliza Bennet
In a significant breach involving Brazil's financial systems, hackers managed to pilfer approximately $140 million from reserve accounts linked to the country's central bank. The attack involved a breach of São Paulo-based software vendor C&M Software on June 30, where insider help played a crucial role. According to investigations, Joao Nazareno Roque, an employee of C&M, allegedly sold his corporate login credentials for a small sum and further aided the attackers by developing a secondary access tool, granting them direct access to the vendor’s infrastructure. The exploit allowed unauthorized instructions to siphon funds from the central bank's reserve accounts to commercial bank accounts, which were then converted to cryptocurrencies like Bitcoin, Ethereum, and USDT.
The cybercriminals orchestrated the complex heist using fraudulent logins to access the system connected to multiple Brazilian financial institutions. Around six banks linked to the Reserve were affected. Blockchain investigator ZachXBT reported that a sizable portion of the stolen funds was swiftly converted to digital assets, complicating the recovery efforts. It is estimated that between $30 million and $40 million worth of funds were already exchanged and laundered through Latin American exchanges and over-the-counter (OTC) trading platforms.
As a response, the Central Bank of Brazil immediately directed institutions using C&M’s services to disconnect to prevent further damage while maintaining that critical systems remained uncompromised. C&M, cooperating fully with local authorities including the Federal Police, stated that the breach was due to exploited client credentials rather than any inherent flaw within their software. Efforts to freeze the involved accounts are ongoing, and Brazilian law enforcement officials have successfully frozen approximately $49.8 million so far.
Further investigations revealed the use of sophisticated laundering operations spread across Brazil, Argentina, and Paraguay. The attackers struggled initially to convert their loot in Brazilian OTC desks due to red flags raised by the substantial amounts. Despite the challenges, exchange operators are now freezing balances linked to suspicious transactions. The investigation continues under federal guidance, with a strong focus on fund recovery and identifying the rest of the criminal network behind the operation. The authorities are also contemplating enhancing security protocols for financial systems connected to the central bank.
