Brazil central bank readies real-time crypto alert system after 180 million USD cyberattack

Brazil’s central bank is preparing to activate a real-time cryptocurrency threat alert system developed with blockchain security firm Hypernative, a project that gained urgency after attackers converted part of an estimated 180 million USD theft into crypto following a major breach of the country’s financial infrastructure.

According to a report by Valor Econômico, the Central Bank of Brazil developed the monitoring and alert-sharing system together with Hypernative and has already tested the tool with market participants. Integration is expected to begin within two weeks, with major domestic exchanges Foxbit and Mercado Bitcoin among the crypto companies participating in the rollout.

## How the alert system works

The system is designed to help financial institutions identify attacks, respond to suspicious activity and track funds as stolen money moves from the banking system into cryptocurrency markets. Alerts generated in one part of the financial system will be distributed to participating institutions, reaching companies that may encounter the funds later in the movement chain.

Regina Pedroso, executive director of the Brazilian Tokenization Association (ABToken), said discussions about the project began late last year, when the central bank approached industry associations and market participants about forming a working group focused on monitoring cyberattacks and sharing warnings. ABToken participated in those early discussions.

Testing has since been completed with a group that included both banks and crypto companies, and some alerts have already been issued. The next stage requires participating associations and firms to adapt their systems so they can receive and redistribute the warnings.

“The challenge now is to implement the tool,” Pedroso told Valor Econômico. “It has already been tested by the Central Bank, some bulletins have already been issued, and now associations have to adapt to receive and distribute the alert.”

Hypernative specializes in detecting onchain threats and responding to suspicious activity before or during attacks. Its work with the Brazilian regulator covers monitoring patterns that could indicate stolen funds moving toward crypto exchanges, where assets can be converted or transferred onward to other wallets.

The design addresses a practical problem in financial crime enforcement: banks and exchanges operating separately each see only different stages of the same movement. A cyberattack can originate inside conventional financial infrastructure while its proceeds later pass through exchanges, stablecoins and blockchain wallets. By connecting the two sides in real time, the central bank aims to preserve traceability across the boundary.

## The 180 million USD C&M attack

The project’s timeline accelerated sharply after the 2025 attack involving C&M Software, a financial technology provider that connects financial institutions to infrastructure used across Brazil’s banking system.

Attackers compromised systems connected to Brazilian financial institutions and siphoned funds from reserve accounts before converting part of the stolen money into cryptocurrency. Estimates placed the total taken between 140 million and 180 million USD.

The crypto trail that followed illustrated exactly the gap the new system is meant to close. Blockchain investigator ZachXBT helped Brazilian authorities trace between 30 million and 40 million USD connected to the attack, with some of the stolen funds converted into Bitcoin, Ether and USDT through Brazilian exchanges and over-the-counter platforms. Working with Binance, Bitso, Bybit and Tether, the investigator helped freeze roughly 5 million USD linked to the stolen funds, while Brazilian authorities separately froze about 50 million USD by early July 2025.

The breach also had a human element: authorities arrested an employee of C&M accused of selling login credentials that were subsequently used by the attackers.

Brazilian authorities have since leaned further into blockchain-based investigation. Days after the C&M case, Tether assisted authorities with Operation Magna Fraus, a fraud investigation that the stablecoin issuer has cited as an example of onchain forensics supporting traditional law enforcement.

## Tighter transfer rules coming in 2027

The monitoring system is not the only measure Brazil is preparing. The country will separately require a 24-hour preventive hold on qualifying crypto transfers above 10,000 USD starting in January 2027, adding a friction layer designed to slow down illicit flows before they become irreversible.

Together, the two measures position Brazil among the more aggressive jurisdictions in building crypto-adjacent financial crime infrastructure — notable for a country that has also been one of the world’s most active crypto adoption markets. The central bank’s approach differs from blanket restrictions: rather than limiting legitimate crypto activity, it focuses on connecting the dots between traditional finance and crypto rails when crimes cross that boundary.

For exchanges like Foxbit and Mercado Bitcoin, participation means integrating alert redistribution into their compliance workflows within weeks. For the broader industry, Brazil’s model — a central bank-operated threat-sharing network that treats crypto firms as integral financial-system participants rather than outsiders — could become a template other regulators study closely.

The rollout’s success will hinge on speed. In the C&M case, tens of millions of dollars moved through exchanges before freezes could catch up. A real-time alert network is precisely the tool meant to shrink that window — and the two-week integration countdown is now underway.

Disclaimer: This article is for informational purposes only and does not constitute financial advice.