Brazil central bank prepares crypto monitoring system after major cyberattack fallout
Brazil’s central bank is building a real-time crypto threat alert system with Hypernative as authorities tighten controls after a major 2025 cyberattack that pushed stolen money into crypto rails.
- Real-time alerts between banks and exchanges
- Hypernative integration expected within two weeks, according to ABToken
- C&M Software-linked attack put stolen funds into crypto
- New 24-hour hold rules start Jan. 1, 2027
- Brazil is tightening oversight, not banning crypto
The system is meant to help banks, domestic exchanges, and industry groups share warnings when suspicious funds start moving from traditional finance into crypto. According to Valor Econômico, the tool has already been tested with market participants, including banks and crypto companies, and some alerts have already gone out.
Regina Pedroso, executive director of ABToken, said integration should begin within the next two weeks.
“The challenge now is to implement the tool, ”
“It has already been tested by the Central Bank, some bulletins have already been issued, and now associations have to adapt to receive and distribute the alert.”
That’s the real bottleneck. Building a monitoring system is one thing. Getting banks, exchanges, and associations to react quickly and in sync is where these efforts usually get messy.
The timing makes sense. The project appears to have picked up urgency after a 2025 cyberattack tied to C&M Software, in which attackers stole as much as $180 million. Estimates for the theft ranged from $140 million to $180 million, and part of the stolen money was converted into cryptocurrencies.
That matters because once stolen funds hit crypto rails, the response window gets short. The money can move fast, split across wallets, and disappear into a tangle of transfers before anyone can catch up.
In July 2025, Brazil Central Bank Orders 24-Hour Hold on Crypto Transfers reported that blockchain investigator ZachXBT helped Brazilian authorities trace between $30 million and $40 million connected to the attack. ZachXBT also worked with Binance, Bitso, Bybit, and Tether to freeze roughly $5 million linked to the stolen funds. By early July, Brazilian authorities had separately frozen about $50 million.
Authorities also arrested an employee accused of selling login credentials used in the attack. That part is grim, but not exactly surprising. In a lot of major breaches, the weak point is not some cinematic mastermind. It’s an insider, a credential leak, or a vendor with too much access and not enough discipline.
Tether later assisted Brazilian authorities with Operation Magna Fraus, a separate case involving funds stolen through the Pix payment system and moved into USDT. In that operation, authorities seized R$5.5 million in cryptocurrency and froze another R$32 million, worth about $5.7 million at the time. Different investigation, same basic lesson: speed matters more than slogans once money is already moving.
Brazil is also adding a more direct brake on suspicious transfers. Starting Jan. 1, 2027, virtual asset service providers must impose a 24-hour preventive hold on qualifying transfers above $10, 000. The threshold can apply to a single transaction or to a customer’s combined transactions during the same day.
The rule also covers qualifying transfers involving foreign crypto providers and self-custody wallets. For readers less familiar with the term, a self-custody wallet is one controlled directly by the user rather than an exchange or custodian. That gives users more control, but it also makes reversals much harder once a transfer is sent.
Providers may release transactions before the 24 hours are up if required risk checks are completed. They must also notify customers when the safeguard is applied and keep records of attempted fraud and their responses. In plain English: Brazil wants a pause button when money looks suspicious.
That’s a classic anti-fraud move. It won’t stop every scam, but it can slow down the kind of account takeover or cash-out attempt that depends on moving quickly before anyone notices. Criminals hate friction. Honest users usually hate it too, but for different reasons.
The central bank is not stopping at transfer holds. In July, it approved new prudential requirements covering capital, risk management, and disclosure standards for crypto service providers. Virtual asset service providers, meaning crypto exchanges, custodians, brokers, and similar firms, are set to move into Brazil’s S4 regulatory segment by mid-2028.
Institutions in the lighter S5 framework will not be allowed to provide virtual asset services. That’s a fairly blunt message: if you want to handle digital assets in Brazil, you do not get to play in the kiddie pool.
Licensing or renewal applicants must submit independent audit reports covering AML controls, customer asset segregation, internal risk management, and employee compliance programs. Licensed exchanges must also prove asset sufficiency daily from Jan. 1, 2027.
Those requirements are not cosmetic. They are the kind of controls regulators reach for when they want a sector to behave more like a serious financial business and less like a website with a token and a prayer. For more background on the compliance angle, see Brazil's Central Bank Regulates Virtual Asset Service.
Brazil has also drawn a line around how crypto can be used in regulated foreign exchange activity. Resolution BCB No. 561 prevents regulated electronic foreign exchange providers from settling covered international transactions using crypto assets.
That does not mean Brazil is banning crypto. It means crypto should not become a backdoor settlement rail for regulated FX flows. There is a difference, and regulators are making sure the market understands it.
For crypto markets, the bigger picture is clear. Brazil is pairing real-time threat detection with stricter compliance rules, transaction delays, and heavier supervision of firms. That is a more coherent approach than either blind acceptance or outright hostility.
It also reflects a broader truth about crypto crime: onchain transparency helps, but it is not magic. Funds can still be routed through mixers, bridges, nested wallets, or multiple chains. The best outcome is often not perfect recovery, it is faster detection, faster freezing, and fewer places for thieves to hide.
Brazil is signaling that it wants crypto to stay usable, but not ungoverned. That will annoy the scammers, the cowboys, and the usual “trust us bro” crowd. Good. Those people were never building anything worth protecting.
For a broader look at the policy direction, Brazil’s central bank has been steadily adding pressure through stablecoin restrictions in regulated cross-border payments and forex rules that squeeze exchanges.
Key questions and takeaways
-
What is Brazil’s central bank building?
A real-time crypto threat alert system with Hypernative that lets banks, exchanges, and industry groups share warnings when suspicious funds start moving into crypto. -
Why does this matter now?
The 2025 C&M Software-linked cyberattack, with reported losses of $140 million to $180 million, showed how quickly stolen money can move from banking systems into crypto. -
What does the 24-hour hold do?
It delays certain qualifying transfers above $10, 000, including some combined same-day transfers, so providers have time to review fraud risk before funds are released. -
Does this apply to self-custody wallets?
Yes. The rule covers qualifying transfers involving self-custody wallets and foreign crypto providers, which makes the policy broader than a simple exchange-only restriction. -
Is Brazil banning crypto?
No. Brazil is tightening oversight, raising compliance standards, and restricting how crypto can be used in certain regulated financial flows. -
Will this stop crypto crime completely?
No. It can improve speed, tracing, and coordination, but sophisticated thieves can still use multiple wallets, bridges, and other tools to muddy the trail. -
Who benefits most from these rules?
Legitimate users, compliant exchanges, and investigators. The people most likely to hate them are the scammers and other fraud merchants who rely on speed, chaos, and weak controls.
Further reading
For the official source on Brazil’s central bank move, start with this brief note from the BCB:
