crypto.news
Brazil’s central bank has developed a real-time crypto threat alert system with Hypernative that will connect banks and domestic exchanges after attackers moved part of an estimated $180 million theft into cryptocurrency.
Valor Econômico reported that the Central Bank of Brazil developed the monitoring and alert-sharing system with blockchain security company Hypernative and has already tested the tool with market participants. The system is designed to help financial institutions identify attacks, respond to suspicious activity and track funds when stolen money moves from the banking system into crypto markets.
Brazil crypto alert system moves toward integration
Regina Pedroso, executive director of the Brazilian Tokenization Association, or ABToken, said integration is expected to begin within the next two weeks. Foxbit and Mercado Bitcoin are among the crypto companies participating in the implementation.
The system is expected to distribute threat information between participating institutions, allowing alerts generated in one part of the financial system to reach companies that may encounter the funds later.
Discussions around the project began late last year, when the central bank approached industry associations and market participants about creating a working group focused on monitoring cyberattacks and sharing warnings. ABToken participated in those discussions.
Testing has since been completed with a group that included banks and crypto companies, while some alerts have already been issued. The next stage requires participating associations and companies to adapt their systems so they can receive and redistribute the warnings.
“The challenge now is to implement the tool,” Pedroso said, according to Valor Econômico. “It has already been tested by the Central Bank, some bulletins have already been issued, and now associations have to adapt to receive and distribute the alert.”
Hypernative specializes in detecting onchain threats and responding to suspicious activity before or during attacks. Its work with the Brazilian regulator covers monitoring patterns that could indicate stolen funds are moving toward crypto exchanges, where assets can be converted or transferred to other wallets.
The central bank’s project focuses in part on maintaining traceability when illicit funds leave traditional financial channels and enter cryptocurrency infrastructure. Banks and exchanges operating separately can see different stages of the same movement, making information sharing part of the system being developed.
$180 million C&M attack accelerated the project
Work on the system gained urgency following the attack involving financial software provider C&M Software in 2025.
Attackers compromised infrastructure connected to Brazilian financial institutions and siphoned funds from reserve accounts before converting part of the stolen money into cryptocurrencies. Estimates placed the total amount taken between $140 million and $180 million.
Crypto.news previously reported in July 2025 that blockchain investigator ZachXBT helped Brazilian authorities trace between $30 million and $40 million connected to the attack. Some of the stolen funds were converted into Bitcoin, Ether and $USDT through Brazilian exchanges and over-the-counter trading platforms.
ZachXBT worked with Binance, Bitso, Bybit and Tether to freeze roughly $5 million linked to the stolen funds. Brazilian authorities had separately frozen about $50 million by early July while investigators continued pursuing people suspected of participating in the operation.
The breach involved C&M, which provides technology connecting financial institutions to infrastructure used by Brazil’s financial system. Authorities arrested an employee accused of selling login credentials that were subsequently used by the attackers.
Movement of the proceeds into crypto demonstrated the problem the new alert network is designed to address: a cyberattack can originate inside conventional financial infrastructure while some of the proceeds later pass through exchanges, stablecoins and blockchain wallets.
Brazilian authorities have used blockchain tracking in other investigations. Days after the C&M case, Tether assisted authorities with Operation Magna Fraus, an investigation into a network accused of moving funds stolen through Brazil’s Pix payment system into $USDT.
Authorities seized R$5.5 million in cryptocurrency during that operation and froze another R$32 million, worth about $5.7 million at the time. Investigators recovered a private key connected to illicit assets, allowing the funds to be transferred into state custody.
Brazil adds 24-hour hold for some crypto transfers
The alert network is being prepared as Brazil introduces separate safeguards governing how crypto service providers process certain transactions.
Starting Jan. 1, 2027, virtual asset service providers will be required to impose a 24-hour preventive hold on qualifying transfers above $10,000 under rules published by the Central Bank on Aug. 7.
The threshold can apply to a single transaction or a customer’s combined transactions during the same day. The measure covers qualifying transfers involving foreign crypto providers and self-custody wallets, while smaller transactions may face closer examination when providers identify elevated risk.
Providers can release transactions before the full 24-hour period expires after completing required risk checks. They must notify customers when the safeguard is applied and retain records covering attempted fraud and actions taken in response.
The central bank said the measure addresses the use of virtual assets, including stablecoins, to move proceeds from financial fraud rapidly, particularly when funds are transferred outside Brazil or into wallets directly controlled by users.
The transaction hold and threat-alert network operate at different stages. The alert system is intended to distribute information about potential attacks and suspicious fund movements, while the transfer rule gives regulated providers additional time to review certain transactions before assets leave their platforms.
Central bank tightens requirements for crypto providers
Brazil has introduced several other requirements for virtual asset service providers ahead of the country’s licensing framework taking fuller effect in 2027.
In July, the central bank approved new prudential requirements covering capital, risk management and disclosure standards for crypto service providers.
Virtual asset firms are set to move into Brazil’s S4 regulatory segment by mid-2028, placing them under requirements closer to those applied to securities brokers and distributors. Institutions operating under the lighter S5 framework will not be permitted to provide virtual asset services.
Crypto companies applying for authorization or renewing licenses must submit independent audit reports examining anti-money laundering controls, customer asset segregation, internal risk management and employee compliance programs.
Licensed exchanges will face another reporting requirement from Jan. 1, 2027, when they must prove asset sufficiency daily. The framework requires customer and company assets to be segregated and introduces accounting requirements for crypto holdings.
Brazil has separately restricted the use of virtual assets inside regulated cross-border payment channels. Resolution BCB No. 561 prevents regulated electronic foreign exchange providers from settling covered international transactions using crypto assets, although cryptocurrency trading and transfers remain permitted outside those supervised payment rails.
For the threat-monitoring project, participating banks, exchanges and industry associations are now moving from testing into implementation. Pedroso said Foxbit and Mercado Bitcoin will participate as the system begins integration, while associations prepare to receive and distribute alerts generated through the network.