Brazil Builds Real-Time Crypto Threat Alert Network

Brazil launches a real-time crypto threat alert system

Brazil’s central bank has moved rapidly to develop a real-time crypto threat monitoring and alert-sharing network after attackers converted part of an estimated $140–$180 million heist into cryptocurrencies. Built in partnership with blockchain security firm Hypernative, the system will link banks, domestic exchanges and industry associations to help detect cyberattacks, trace stolen funds onchain and share actionable warnings across the financial ecosystem.

Why the alert network matters for banks, exchanges and crypto users

The initiative responds to an acute pain point for regulators and market participants: when fraud or cyberattacks originate inside traditional finance, proceeds can quickly flow through exchanges, over-the-counter desks, stablecoins and self-custody wallets, eroding traceability and complicating investigations. By sharing alerts in real time, participating institutions will be able to spot suspicious fund movements earlier, block or freeze risky transactions, and coordinate follow-up tracing efforts across offchain and onchain channels.

Hypernative’s tooling focuses on onchain threat detection and rapid response, flagging patterns that indicate funds are being routed into exchanges or mixed wallets. The central bank’s network is intended to ensure that alerts generated by banks, payment processors or a regulator reach crypto platforms that might see the funds later, closing visibility gaps between separate parts of the financial system.

Integration timeline and early participants

Regina Pedroso, executive director of the Brazilian Tokenization Association (ABToken), said integration into participant systems is expected to start within roughly two weeks. Local exchanges Foxbit and Mercado Bitcoin are among the companies confirmed to take part in the initial rollout after a formal testing phase.

Testing has already been completed with a working group that included banks and crypto firms, and some bulletins have been issued during that pilot. The next step requires associations and firms to adapt their internal messaging and compliance systems so they can receive, interpret and re-distribute the alerts automatically.

What prompted the accelerated timeline: the C&M attack

The program gained urgency after the high-profile compromise of C&M Software in 2025. Attackers allegedly abused C&M infrastructure that connects multiple financial institutions, draining reserve accounts and then converting part of the stolen proceeds into cryptocurrencies. Estimates of the total amount taken ranged between $140 million and $180 million.

Blockchain investigators traced significant sums as they entered exchanges and OTC channels. Independent investigator ZachXBT helped local authorities follow approximately $30–$40 million tied to the breach. Cooperation with major crypto firms and stablecoin issuers led to freezes of roughly $5 million by Binance, Bitso, Bybit and Tether, while Brazilian law enforcement separately froze about $50 million during the probe.

The case illustrated how rapidly illicit flows can migrate from conventional rails into crypto, underscoring the need for faster, automated information sharing so exchanges and banks can act before funds are dispersed across multiple chains and wallets.

Cooperation, tracing and criminal investigations

Authorities arrested an employee suspected of selling login credentials that the attackers used to access connected systems. The movement of proceeds into Bitcoin, Ether and USDT highlighted the value of onchain analytics for follow-the-money work, and reinforced calls for tighter operational coordination between public and private actors.

Brazilian law enforcement has used blockchain tracing in parallel investigations. For example, days after the C&M incident, Tether assisted with Operation Magna Fraus, which targeted a network accused of moving funds stolen through Brazil’s Pix payment system into USDT. That operation led to the seizure of R$5.5 million in cryptocurrency and the freezing of another R$32 million, after investigators recovered a private key linked to illicit holdings.

How the alert network and new rules complement each other

The threat-alert network operates alongside a separate regulatory change that introduces a preventive pause for certain crypto transfers. From Jan. 1, 2027, virtual asset service providers (VASPs) in Brazil will be required to impose a 24-hour preventive hold on qualifying transfers that exceed $10,000, based on rules published by the Central Bank in August.

The hold threshold applies to single transactions or aggregated customer transfers during the same day. It covers transfers to foreign crypto providers and self-custody wallets when they meet the materiality and risk criteria. Providers must notify customers when a hold is applied, retain records of suspected fraud, and can release funds earlier if required risk checks are completed successfully.

Different tools for different stages of a fraud lifecycle

While the alert network is designed to distribute information about suspicious activity and potential attacks detected across the financial ecosystem, the preventive hold provides regulated firms with procedural time to perform enhanced due diligence before assets leave their platforms. Together, the two measures strengthen both detection and response: alerts help detect and trace suspicious flows, and the hold gives firms a concrete window to act.

Stricter prudential rules and licensing changes

Brazil is also tightening prudential and supervision standards for VASPs ahead of its broader licensing framework taking fuller effect in 2027 and 2028. In July, the central bank approved new requirements covering capital, risk management and disclosure standards for crypto service providers.

Under the evolving framework, virtual asset firms are expected to enter Brazil’s S4 regulatory segment by mid-2028, bringing oversight closer to the rules applied to securities brokers and distributors. Entities operating under the lighter S5 classification will not be permitted to provide virtual asset services.

Firms seeking authorization or license renewals must provide independent audit reports assessing anti-money laundering controls, customer asset segregation, internal risk management and employee compliance programs. Additionally, licensed exchanges will have a daily asset sufficiency reporting requirement beginning Jan. 1, 2027, while accounting rules will require clearer segregation of customer and company crypto holdings.

Cross-border payments and crypto restrictions

The central bank has also limited certain uses of crypto in regulated cross-border payment channels. Resolution BCB No. 561 prevents regulated electronic foreign exchange providers from settling covered international transactions using crypto assets. That restriction does not prohibit crypto trading or transfers outside supervised payment rails, but it narrows the channels through which virtual assets can be used in regulated cross-border settlements.

Implementation challenges and expected benefits

Operationalizing a real-time alert network across diverse institutions will pose technical and governance challenges. Banks, exchanges and industry associations must standardize message formats, integrate APIs, configure compliance workflows, and agree on escalation protocols for different alert severities. Data privacy and false-positive management will also be critical to avoid overblocking legitimate transfers.

Nevertheless, when implemented effectively the system should deliver tangible benefits: faster detection of coordinated attacks, improved ability to trace proceeds onchain, stronger collaboration between traditional finance and crypto markets, and a reduction in the speed at which illicit funds can be laundered through exchanges and stablecoins.

What market participants should prepare for

Crypto firms and banks operating in Brazil should prioritize integration testing, update transaction monitoring rules to consume alerts, and ensure customer-facing teams are ready to communicate holds and investigatory outcomes. Compliance teams will need to adapt case management, forensic tracing and suspicious activity reporting processes to take advantage of the new information flows.

For international exchanges and service providers with Brazilian customers, the evolving rules signal the importance of robust onchain analytics, rapid collaboration with local authorities, and stringent AML and custody practices.

Outlook

Brazil’s move to combine an alert-sharing network with preventive transfer holds and tighter prudential standards marks a significant step toward a more resilient crypto ecosystem. The C&M attack was a stark reminder that cybercriminals can bridge legacy financial channels and the crypto economy quickly, and that cross-sector coordination is essential to limit the damage.

If the Hypernative-powered network and related regulatory measures function as intended, Brazil could set a model for blending onchain threat detection, fast information sharing, and regulatory safeguards that other jurisdictions might emulate as they confront similar hybrid fraud risks in the digital asset era.