The C&M Software attack: what is known about the diversion of reserve accounts linked to Pix
Legitimate credentials from an IT operator were used to send transfers from reserve accounts at the Central Bank of Brazil. Police cite R$541 million; other estimates reached R$1 billion.
Historical reference: July 4, 2025. Published on this site on November 2, 2026. Dates in the text identify the period covered.
In this article
Key points
- C&M Software, which connects smaller institutions to the financial system, was used to divert money from reserve accounts held at the Central Bank of Brazil. The diversion happened in the early hours of June 30.
- The amount confirmed by police is about R$541 million, from BMP. The figures of R$800 million and more than R$1 billion that circulated in the first days are estimates.
- There was no technical break-in: according to police, legitimate credentials were handed over by an IT operator, arrested on July 3.
- Part of the money became crypto: US$30 million to US$40 million, according to investigator ZachXBT. A court froze R$270 million in one account.
São Paulo, July 4, 2025 — Four days after the attack on C&M Software, answers are still missing on the total amount, the perpetrators and where the money went, but the shape of the crime is clear: nobody broke Pix's encryption. Someone with legitimate access handed over the key.
- Loss declared by BMP to police (the only amount officially attributed to a victim)
- R$541M
- Institutions with unauthorized access to reserve accounts, according to BMP
- 6
- Frozen by a court in one account that received part of the money
- R$270M
- Initial estimate published by part of the press, not confirmed
- R$1B
What happened
C&M Software is a São Paulo company that provides connection infrastructure to the Central Bank of Brazil for institutions without their own, such as digital-account fintechs. According to Reuters, the attack took place on Monday, June 30, and the Central Bank only made it public on Wednesday, July 2. Decrypt places the fraudulent transfer orders between 4 a.m. and 7 a.m. that day, and police opened an investigation on June 30 itself.
The funds left reserve accounts, held directly at the Central Bank and used only for settlement between institutions. They are not customer accounts. BMP, the most frequently cited victim, told Reuters that customers were not affected and that it has guarantees to cover the diverted amount. BMP said that it and five other institutions had unauthorized access to their reserve accounts.
- 06/30Between 4 a.m. and 7 a.m., fraudulent Pix orders leave the reserve accounts of six institutions. Police open an investigation the same day, after a police report.
- 07/02The Central Bank makes the case public and orders C&M to block the institutions' access to the infrastructure it operates.
- 07/03São Paulo's Civil Police arrest a C&M IT operator at night. The Central Bank replaces C&M's precautionary suspension with a partial suspension.
- 07/04Police detail the case. The Central Bank suspends Transfeera, Soffy and Nuoro Pay from Pix as a precaution.
How the attack was carried out
C&M said it was a direct victim of the attack. The company's commercial director, Kamal Zogheib, told Reuters that criminals fraudulently used customer credentials and that the company's critical systems remained intact.
Police added the central element: recruitment of an insider. According to CNN Brasil, the arrested C&M IT operator, 48, confessed to having been recruited by third parties and to having helped the criminals get into the system and request Pix transfers from the Central Bank. Decrypt, citing the investigations, reported payments totaling R$15,000 for the credentials and for help assembling the software used.
Pix and the Central Bank's infrastructure worked as designed: the transfer request came from authorized access. The weak link was the person and their work environment. The pattern recalls the data leak caused by bribed Coinbase support agents and, in a different way, the Bybit attack, in which authorized people signed a tampered order: the technology holds up, human access does not.
How much was diverted: what is confirmed and what is an estimate
The numbers changed by the hour. Separating them helps in reading the headlines:
| Amount | Who said it | Status |
|---|---|---|
| R$541 million (R$542 million in one passage) | São Paulo Civil Police, based on BMP's police report | Declared by one victim; it is the highest official amount |
| At least R$400 million | Press, July 2 to 3 | Initial estimate |
| About R$800 million | Press and on-chain analyst estimates | Estimate, with no official confirmation |
| More than R$1 billion | Part of the press on the first day | Estimate; an official source said the amounts did not reach billions |
An official who spoke to Reuters on condition of anonymity said C&M serves about two dozen small institutions and that the amounts did not reach billions of reais. The Central Bank did not release a list of victims or the total.
Where the money went
The money was scattered through Pix and transfers to accounts at other institutions and, in part, converted into crypto. The Central Bank precautionarily suspended Transfeera, Soffy and Nuoro Pay from Pix for up to 60 days while it checks whether they have any link to the diversion. Transfeera said that neither it nor its customers were affected and that its other services continue as normal.
On-chain analyst ZachXBT estimated, according to Decrypt, that at least US$30 million to US$40 million was swapped for bitcoin, ether and USDT through OTC desks and Latin American exchanges before accounts were frozen. This is an estimate based on public wallet tracing, not official data. In parallel, a court ordered the freezing of R$270 million in one account that received part of the money.
Rapid conversion is typical: whoever diverts money through Pix tries to turn it into an asset that crosses borders before a freeze arrives. The traceability of public networks, however, helps police, and issuers such as Tether freeze balances when they receive formal requests.
The Central Bank's response
- It disconnected C&M from the infrastructure and ordered the client institutions' access to the structure it operates to be blocked.
- On July 3, it replaced the precautionary suspension with a partial suspension, after the company adopted measures to reduce the risk of new incidents.
- On July 4, it suspended Transfeera, Soffy and Nuoro Pay from Pix. The basis is art. 95-A of the Pix regulation, which allows suspending a participant whose conduct puts the functioning of the arrangement at risk, Poder360 reported.
What companies should take from the case
The case does not change the security of Pix for those who use it day to day, but it is a warning for any company that depends on providers and privileged access:
The investigation remains open: the masterminds have not been identified, and the total diverted and the official list of victims are still missing. This text gathers what was public on July 4; new numbers depend on communications from the Central Bank and the police.
Frequently asked questions
Was Pix hacked in the C&M Software attack?
No. According to police, there was no technical break-in of Pix or the Central Bank: legitimate credentials, with the help of an IT operator, were used to send transfer requests. The Central Bank disconnected C&M as a precaution.
Was customer money diverted?
BMP, the main victim, said the diversion occurred in reserve accounts held at the Central Bank, used only for settlement between institutions, with no impact on customer accounts. As of July 4, there was no official confirmation of customer losses.
How much was diverted in the C&M attack?
The highest official amount is BMP's, about R$541 million, declared to police. Figures of R$800 million and more than R$1 billion circulated as estimates. The Central Bank did not release the total as of July 4.
What is a reserve account?
It is the account that some financial institutions hold at the Central Bank to settle payments among themselves, including Pix payments. It is not a customer account; the balance belongs to the institution itself.
Found it useful? Share it with anyone who pays suppliers abroad.
Sources
- Ataque contra C&M Software atinge contas reservas de instituições financeiras (Reuters) · InfoMoney, Jul 2, 2025
- Polícia Civil de SP prende suspeito de envolvimento em ataque cibernético à C&M Software (Reuters) · Forbes Brasil, Jul 4, 2025
- Ataque hacker desviou R$ 541 milhões em massa, diz polícia · CNN Brasil, Jul 4, 2025
- BC suspende 3 instituições do Pix após ataque cibernético · Poder360, Jul 4, 2025
- How a Hacker Spent Only $2.7K to Steal $140 Million From Brazilian Banks · Decrypt, Jul 4, 2025
For information only, not investment advice. Third-party brands mentioned belong to their owners; the mention is journalistic and does not indicate a partnership or relationship with Swapo Finance.
International payments with the speed of Pix and Central Bank rules.
Convert reais into USDT and send it to your supplier on the TRON network. One fee shown upfront, asset segregation policy, human support. Virtual assets have no FGC coverage; authorization application filed with the BCB.
