C&M Cyberattack Leads to $140 Million Theft, $5 Million Recovered

On June 30, a cyberattack targeted C&M, a technology provider linked to the Central Bank, resulting in the theft of $140 million in fiat currency. The breach affected six financial institutions that utilized the compromised software. Hackers gained full access to critical banking systems after purchasing employee credentials for a mere $3,000, enabling them to transfer large sums without immediate detection by authorities or banks.

Blockchain investigator ZachXBT revealed that approximately $40 million of the stolen fiat funds were swiftly converted into cryptocurrencies, including Bitcoin, Ethereum, and Tether. The conversion went undetected initially, with no early alerts issued publicly. ZachXBT began tracing the stolen crypto by observing abnormal volume spikes across Brazilian exchanges on the same day as the breach. By manually monitoring hot wallet transactions, he linked the crypto activity to the bank theft timeline.

Through cooperation with Binance, Bitso, Bybit, Tether, and Chainalysis, approximately $5 million in crypto assets have been frozen. These funds were spread across multiple blockchains and centralized exchanges. The frozen amount only reflects assets recovered at this stage. The investigation is still ongoing, and the activity of the wallets is still being observed.

While most platforms assisted in halting the flow of stolen funds, Circle received public criticism from ZachXBT for not participating in the tracking process. He noted that Circle’s leadership did not support the investigation despite its relevance to the broader crypto sector. With no early involvement from government authorities, much of the investigation was conducted by independent analysts and private firms. ZachXBT’s tracing work played a central role in identifying and limiting the laundering operation.

Although the magnitude of the incident was significant, Brazilian authorities have yet to provide any additional information on the suspects and have not made any arrests in relation to the laundering. The investigation is still ongoing, and the activity of the wallets is still being observed.