Brazil’s central bank is preparing a real-time cryptocurrency threat monitoring system designed to help banks and crypto exchanges respond more quickly to cyberattacks and suspicious fund movements.
Developed alongside blockchain security company Hypernative, the system will connect financial institutions with domestic cryptocurrency exchanges, allowing participating organizations to share alerts when potentially stolen funds move between traditional banking networks and blockchain platforms.
The project has gained additional urgency following a major cyberattack involving Brazilian financial technology provider C&M Software in 2025. Attackers reportedly stole between $140 million and $180 million, with some of the funds later converted into cryptocurrencies.
Integration of the new monitoring network is expected to begin shortly, with Brazilian crypto exchanges Foxbit and Mercado Bitcoin among the companies participating.
Brazil Moves Crypto Threat System Toward Integration
The Central Bank of Brazil has already tested the monitoring and alert-sharing system with financial market participants.
The technology is intended to help institutions detect potential attacks, identify suspicious transactions and follow stolen funds when money moves from traditional financial systems into cryptocurrencies.
According to Regina Pedroso, executive director of the Brazilian Tokenization Association, or ABToken, integration is expected to begin within the next two weeks.
Foxbit and Mercado Bitcoin are among the cryptocurrency companies expected to participate in the implementation.
The system will allow threat information generated by one institution to be shared with other participating organizations.
This could become particularly useful when stolen money moves through several parts of the financial system.
For example, a suspicious transaction initially identified by a bank could later appear at a cryptocurrency exchange. Sharing alerts between institutions could help exchanges identify those funds more quickly and take appropriate action.
Central Bank Already Tested the Alert Network
Discussions surrounding the monitoring system began late last year.
Brazil’s central bank approached industry associations and financial market participants about establishing a working group dedicated to cyberattack monitoring and threat-information sharing.
ABToken participated in those discussions.
Testing has since been conducted with both banks and cryptocurrency companies, and some alerts have already been issued through the system.
The next stage involves participating associations and businesses adapting their internal systems so they can receive and redistribute these warnings.
Hypernative’s role is particularly important because the blockchain security company specializes in detecting on-chain threats and identifying suspicious activity before or during attacks.
Its work with Brazilian authorities includes monitoring blockchain patterns that could indicate stolen funds are being transferred toward cryptocurrency exchanges or other digital wallets.
$180M C&M Cyberattack Increased Urgency
The development of Brazil’s crypto monitoring network became more urgent following the 2025 cyberattack involving C&M Software.
C&M provides technology connecting financial institutions with infrastructure used throughout Brazil’s financial system.
Attackers reportedly compromised infrastructure linked to Brazilian financial institutions and siphoned money from reserve accounts.
Estimates placed the total amount stolen between approximately $140 million and $180 million.
Part of the stolen money was subsequently converted into cryptocurrencies, demonstrating how quickly funds from an attack on traditional financial infrastructure can enter blockchain networks.
Blockchain investigator ZachXBT later assisted Brazilian authorities in tracing approximately $30 million to $40 million connected to the attack.
Some of the stolen funds were reportedly converted into Bitcoin, Ether and USDT using Brazilian cryptocurrency exchanges and over-the-counter trading platforms.
Crypto Companies Helped Freeze Stolen Funds
Several major cryptocurrency companies also assisted investigators.
ZachXBT worked with Binance, Bitso, Bybit and Tether to freeze approximately $5 million associated with the stolen funds.
Brazilian authorities had separately frozen roughly $50 million by early July as investigators continued pursuing individuals suspected of participating in the attack.
Authorities also arrested a C&M employee accused of selling login credentials that were later allegedly used by the attackers.
The case highlighted an important challenge facing regulators.
A cyberattack can begin within traditional banking infrastructure, but the stolen money can quickly move into cryptocurrency exchanges, stablecoins and self-custody wallets.
Banks and cryptocurrency platforms may only see individual stages of those transactions.
Brazil’s new monitoring network is intended to connect those different pieces of information.
Brazil Uses Blockchain Tracking in Other Investigations
Brazilian authorities have also relied on blockchain tracking during other financial crime investigations.
Shortly after the C&M incident, Tether assisted authorities with Operation Magna Fraus, an investigation involving a network accused of moving funds stolen through Brazil’s Pix payment system into USDT.
Authorities reportedly seized R$5.5 million in cryptocurrency and froze another R$32 million, worth approximately $5.7 million at the time.
Investigators also recovered a private key associated with illicit assets, allowing cryptocurrency to be transferred into government custody.
Cases like these demonstrate why cooperation between traditional financial institutions and cryptocurrency companies is becoming increasingly important for tracing stolen assets.
Brazil Introduces 24-Hour Hold on Some Crypto Transfers
The threat monitoring network is only one part of Brazil’s broader effort to strengthen cryptocurrency oversight.
Beginning Jan. 1, 2027, virtual asset service providers will be required to impose a 24-hour preventive hold on certain qualifying cryptocurrency transfers exceeding $10,000.
The rules were published by Brazil’s central bank on Aug. 7.
The threshold can apply either to an individual transaction or to a customer’s combined transactions during the same day.
Qualifying transfers involving foreign cryptocurrency providers and self-custody wallets may be covered by the measure.
Transactions below $10,000 could also receive additional scrutiny when providers detect elevated risk.
However, providers will not necessarily have to wait the full 24 hours before releasing a transaction.
Transfers can be approved earlier once the required risk assessments have been completed.
Providers must also inform customers when the preventive measure is applied and maintain records covering suspected fraud attempts and the actions taken in response.
Monitoring System and Transfer Hold Serve Different Purposes
Although both measures are designed to reduce financial crime involving cryptocurrencies, they operate differently.
The real-time threat monitoring network focuses on distributing information between financial institutions about potential attacks and suspicious movements of funds.
The 24-hour transaction rule, meanwhile, gives regulated cryptocurrency providers additional time to examine certain transfers before assets leave their platforms.
Together, the measures could make it more difficult for criminals to rapidly move stolen money from Brazilian financial institutions into overseas platforms or self-controlled wallets.
Brazil Tightens Rules for Crypto Companies
Brazil has introduced several additional requirements as the country prepares for its broader cryptocurrency licensing framework to take effect.
In July, the central bank approved new prudential requirements covering areas such as capital, risk management and disclosures for virtual asset service providers.
Crypto companies are expected to move into Brazil’s S4 regulatory segment by mid-2028.
That would subject them to requirements more closely aligned with those applied to securities brokers and distributors.
Companies applying for authorization or renewing their licenses will also need to submit independent audit reports.
These audits are expected to examine anti-money laundering controls, customer asset segregation, internal risk management procedures and employee compliance programs.
Exchanges Will Need to Prove Asset Sufficiency Daily
Another major requirement will take effect on Jan. 1, 2027.
Licensed cryptocurrency exchanges will be required to demonstrate the sufficiency of their assets on a daily basis.
The framework requires customer assets to remain segregated from company holdings while introducing additional accounting requirements for cryptocurrencies.
Brazil has also placed restrictions on how virtual assets can be used within regulated cross-border payment systems.
Certain regulated electronic foreign exchange transactions cannot be settled using cryptocurrencies, although crypto trading and transfers remain permitted outside those supervised payment channels.
Brazil Strengthens Crypto Security After Major Attacks
Brazil’s upcoming monitoring system represents an effort to close the information gap between banks and cryptocurrency companies.
Instead of financial institutions investigating suspicious transactions independently, participating banks, exchanges and industry associations will be able to share threat information through a connected network.
That could prove particularly valuable during large cyberattacks where stolen funds move rapidly between conventional accounts, exchanges, stablecoins and blockchain wallets.
With testing completed, participating organizations are now moving toward implementation.
Foxbit and Mercado Bitcoin are expected to participate as integration begins, while industry associations prepare their infrastructure to receive and redistribute security alerts.
Combined with preventive transaction holds, stricter capital requirements, independent audits and daily asset checks, the monitoring system demonstrates how Brazil is moving toward tighter supervision of its rapidly developing cryptocurrency sector.
