Skip to content

Invest Reports disagree3 publishers 3 min read Published Updated

Brazilian police took $1.7M from self-custody wallets by finding the seed phrases in raids

Santa Catarina's civil police moved $1.7 million in crypto out of a phishing ring's self-custody wallets, the largest such recovery by Brazilian police. Self-custody left no company to serve with a freeze order. That protection ended once a search found the keys.

The Investor · Invest desk

Send a correction

Illustration accompanying Brazilian police took $1.7M from self-custody wallets by finding the seed phrases in raids
Generated illustration
Operation also froze the group's bank accounts Bank freezes reported by Bitcoin.com News, orders behind the September 10 operation, and the transactions that moved the crypto out.

Nearly $18.5 million in bank accounts linked to the group was frozen. The September 10 operation involved 17 search-and-seizure orders. The funds moved out of the group's wallets in 13 separate transactions.

Operation also froze the group's bank accounts
FigureValueNoteClaim
Bank accounts linked to the group frozen, nearlyUS$18.5 million9
Search and seizure17 orders8
Moves out of the wallets13 transactions3

What happened

  • The September 10 operation ran on 17 search-and-seizure orders and two arrest orders against the group's leaders, Bitcoin.com News reported.
  • Detective Eduardo Graebin said officers found four seed phrases in the raids, then imported and analyzed each wallet to identify its assets before moving them.
  • The funds left the group's wallets in 13 separate transactions, which investigators followed and confirmed with Chainalysis tracing tools.
  • Courts ordered freezes on bank accounts of up to R$93 million, and a further R$5 million of real estate was caught up in the judicial measures.
  • Cryptobriefing says other reports have identified roughly $218,000 in additional funds, and the released material has not explained how that sum relates to the main figure.

Why it matters

  • Who's exposed exposure A seed phrase stored where a search can reach it gives police the same power over a self-custody wallet that a court order gives them over an exchange account.
  • What it sets up precedent Other Brazilian forces now have a worked sequence to copy: seize phrases, import wallets, identify assets with Chainalysis tools, and park the proceeds at a domestic exchange.
  • Who's exposed exposure With Foxbit holding state-seized assets, the recovery depends on a private exchange's security until courts settle what happens to the coins.

Divided across four seed phrases, the haul comes to about $427,000 a phrase, and the 13 transfers averaged roughly $131,000 each [13][14]. Cryptobriefing notes that police usually freeze crypto by serving a court order on the exchange that holds it, and that self-custody leaves no company to receive one [12]. Santa Catarina's officers had the phrases, so they could sign the transfers themselves [7].

In our view, the case shows that self-custody closed one route to the coins and left another open. The ring's setup did block the court-order route. A search warrant got to the same coins through the seed phrases. The counter-case is that blockchain analytics did the hard part, and Bitcoin.com News says Chainalysis supplied tools to help identify the assets [11]. Tracing finds coins, but only a key can sign for them. Graebin credited both skill and software. "This result demonstrates, in a concrete way, how specialized technical knowledge and the use of appropriate tools can represent the difference between locating or failing to seize more than one million reais in assets related to criminal activity," he said [10]. Evidence that police moved funds from a wallet whose phrase they never found would prove us wrong, and neither report describes such a transfer.

The roughly $218,000 flagged in other reports could supply that test [18]. Added to the main figure, it would lift the recovery to about $1.93 million [21]. Or it may sit at addresses investigators traced and could not open.

Next to the rest of the operation, the crypto is the smaller pot. R$8.78 million is about 9% of the up to R$93 million that courts froze in bank accounts [15]. At the R$5.14 per dollar implied by the crypto conversion, R$93 million is about $18.1 million, close to the nearly $18.5 million Bitcoin.com News reported [16][9]. The larger pot, roughly ten times the crypto, sat in bank accounts, where a court order could be served on the bank [6][12].

Santa Catarina's police did not set up their own custody for the coins. They went to an institutional account at Foxbit, a Brazilian exchange, so an intermediary of the kind the ring avoided now holds the proceeds for the state [4]. One way this develops is as a one-off that depended on a ring keeping its phrases where a raid could find them. Another is a template other Brazilian forces copy, with Chainalysis to find the assets and an exchange to store them. The third runs through policy. Cryptobriefing, citing research findings, frames the seizure as a sign of growing scrutiny of self-custody wallets [20]. Finance minister Fernando Haddad has said the government is preparing a regulatory overhaul aimed at criminal use of crypto, Bitcoin.com News reported [19]. We'd expect the template, since every step Graebin described is open to any force that finds the phrases [7].

What to watch

  • Whether the roughly $218,000 is folded into the official tally or turns out to sit in wallets police traced but could not open.
  • What courts decide for the coins held in Foxbit's institutional account, and how long they stay there.
  • The text of the regulatory overhaul Haddad has described, and whether it reaches self-custody wallets directly.

Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence62
Adoption
Not scored
Hype gap+12
Incentives40
Confidence68

Perspective Coverage

3 publishers
Builder
Builder 17%
Operator
Operator 43%
Investor
Investor 40%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    The Civil Police of Santa Catarina seized US$1,708,534 in crypto from self-custody wallets linked to a phishing ring during Operacao ClickFix, carried out on September 10, 2026.

    Reported Supported Source: CryptobriefingView cited source
  2. [2]

    It is the largest self-custody digital asset recovery Brazilian civil police have made to date.

    Reported Supported Source: Cryptobriefing; also Bitcoin.com NewsView cited source
  3. [3]

    The funds moved out of the group's wallets in 13 separate transactions; investigators relied on Chainalysis blockchain tracing tools to follow and confirm the transfers.

    Reported Supported Source: CryptobriefingView cited source
  4. [4]

    The assets landed in an institutional account at Foxbit, a Brazilian exchange, where they sit under state custody; the state leaned on a domestic exchange's institutional infrastructure to hold them.

    Reported Supported Source: CryptobriefingView cited source
  5. [5]

    The operation produced two arrests and the seizure of luxury vehicles, among them a Corvette valued at more than R$1.5 million.

    Reported Supported Source: CryptobriefingView cited source
  6. [6]

    Courts ordered freezes on bank accounts totaling up to R$93 million; another R$5 million in real estate was caught up in the judicial measures.

    Reported Supported Source: CryptobriefingView cited source
  7. [7]

    Detective Eduardo Graebin said police located four seed phrases during the operation and it was necessary to import and analyze the wallets to identify the assets in each one and transfer the funds to the Santa Catarina Civil Police institutional account on Foxbit.

    Reported Supported Source: Bitcoin.com News, reporting GraebinView cited source
  8. [8]

    The operation, executed on September 10, involved 17 search-and-seizure orders and two arrest orders against the group's heads.

    Reported Supported Source: Bitcoin.com NewsView cited source
  9. [9]

    The operation resulted in the freezing of nearly $18.5 million in bank accounts linked to the group.

    Reported Supported Source: Bitcoin.com NewsView cited source
  10. [10]

    "This result demonstrates, in a concrete way, how specialized technical knowledge and the use of appropriate tools can represent the difference between locating or failing to seize more than one million reais in assets related to criminal activity," Graebin said.

    Reported Supported Source: Eduardo Graebin, via Bitcoin.com NewsView cited source
  11. [11]

    In partnership with Chainalysis, which provided tools to help identify the assets, over $1.7 million in crypto was moved in 13 operations and placed under police custody.

    Reported Supported Source: Bitcoin.com NewsView cited source
  12. [12]

    When police want to freeze funds on an exchange they can serve a court order on that company; with self-custody no company sits in the middle to receive the order, making recovery considerably harder.

    Reported Supported Source: CryptobriefingView cited source
  13. [13]

    The seizure averages about $427,000 per seed phrase.

    Derived Supported
  14. [14]

    The 13 transfers averaged about $131,000 each.

    Derived Supported
  15. [15]

    The R$8.78 million crypto haul equals about 9% of the up to R$93 million in frozen bank accounts; the bank freezes are about 10.6 times the crypto.

    Derived Supported
  16. [16]

    The crypto conversion implies about R$5.14 per dollar, which puts R$93 million at about $18.1 million, close to the nearly $18.5 million Bitcoin.com News reported.

    Derived Supported
  17. [17]

    The haul was worth approximately R$8.78 million at the time of the seizure and spread across Bitcoin, Ethereum, TRON and Tether.

    Reported Contested Source: CryptobriefingView cited source
  18. [18]

    Other reports have identified roughly US$218,000 in additional funds; how that amount fits alongside the main seizure figure has not been laid out in the material released so far.

    Reported Insufficient Source: Cryptobriefing, citing other reportsView cited source
  19. [19]

    Fernando Haddad, Brazil's Minister of Finance, said the government is preparing a regulatory overhaul to attack the use of cryptocurrency by organized crime.

    Reported Insufficient Source: Bitcoin.com NewsView cited source
  20. [20]

    Research findings frame the seizure as a sign of increasing regulatory scrutiny over self-custody wallets.

    Reported Insufficient Source: Cryptobriefing, citing research findingsView cited source
  21. [21]

    If the roughly $218,000 is an additional seizure, the total recovery would be about $1.93 million.

    Derived Insufficient

Sources

3 independent publishers whose own reporting we read for this story.

  1. crowdfundinsider.com

    1 article · October 12, 2026

    Brazil Police Seize $1.7M In Crypto In Cybercrime Probe
  2. cryptobriefing.com

    1 article · October 9, 2026

    Brazilian police seize $1.7M in crypto from phishing ring’s wallets
  3. news.bitcoin.com

    1 article · October 9, 2026

    Brazil Seizes Record Crypto Funds From Self-Custody Wallets

Topics and entities

Topics

Entities