C&M Software hack — June 2025

On the night of Monday 30 June 2025, attackers issued fraudulent Pix transfers out of reserve accounts that Brazilian financial institutions hold directly at the central bank, using access to C&M Software, a provider that connects institutions without their own connectivity infrastructure to the Banco Central do Brasil. Reuters reported that the central bank ordered C&M to cut off client access. C&M's commercial director said the company was a direct victim and that the intrusion involved fraudulent use of client credentials rather than a flaw in its systems. The institution BMP told Reuters that it and five others had unauthorised access to their reserve accounts, that no customer accounts were touched, and that it held enough collateral to cover the impacted amount.

São Paulo police arrested João Nazareno Roque, a C&M IT employee. According to police he told investigators he sold his credentials to hackers who had recruited him; The Record reported the payment as about $2,700 in two cash instalments, and G1 reported it as about R$15,000. Police said at least four more people took part and continued tracing assets.

The totals are disputed. Police and the Associated Press put the loss at more than R$540 million, about $100 million, and said that figure covered a single institution with the true total possibly higher; coverage citing researchers has put the total near R$800 million, about $140 million, across six institutions. Authorities blocked R$270 million, roughly $49 million.

The theft itself was of reais on Brazil's payment system. The Record, citing investigator ZachXBT, reported that roughly $30–40 million of the proceeds was converted into bitcoin, ether and USDT through over-the-counter brokers.