Major bank robbery in Brazil with the help of an insider

With insider help, billion-dollar payment system faced collapse
On June 30, 2025, a massive cyberattack shook Brazil’s financial system to its core. It wasn't just a large-scale money theft — it severely challenged the public’s trust in banks. According to local media reports, hackers stole approximately 140 million dollars from six of the country’s largest banks. The key figure behind this breach wasn’t a banker or IT expert, but an ordinary employee who sold his account credentials for a small sum, reported [domain].

The central figure in this crime was João Nazareno Roque, an employee of C&M. His seemingly simple act led to the downfall of an entire financial framework. He gave his personal login data to the attackers for just $2,770. Not stopping there, Roque carried out a series of technical tasks during the attack through the Notion platform, earning an additional $1,850.

Betrayal inside the system – a harsh lesson for banks
C&M is a company that develops software solutions linking Brazilian banks to the Central Bank. Through this very connection chain, hackers infiltrated the systems and exploited vulnerabilities in PIX — the instant payment system used by the vast majority of Brazilians.
Following the attack, it was revealed that one bank alone lost nearly $100 million. This is now considered one of the most severe cyberthreats ever recorded in Brazil’s financial sector.

Hackers moved the money to the crypto world
Renowned cybersecurity analyst ZachXBT reported that between $30–40 million of the stolen funds had already been converted into cryptocurrency. Anonymous trading platforms, off-chain channels, and secure exchange systems were used in the process. These “laundering” techniques allowed the hackers to cover their tracks and quickly distribute the funds via international payment networks. This proves that modern cyberattacks are not just about code, but also financial tactics.

C&M tries to defend itself
Naturally, C&M — being at the center of the crisis — tried to defend its reputation. In an official statement, the company emphasized that the attack wasn’t due to a technical breach but purely social engineering and insider compromise. They claimed no server was damaged, no internal code was breached, and the infrastructure remained intact. But the public found this explanation insufficient, as the issue wasn’t only about a company — it was about the security of the entire financial ecosystem and public trust.

Conclusion:
This cyberattack in Brazil revealed not only the theft of vast sums of money, but also the catastrophic consequences of insider betrayal. One employee’s low-priced mistake turned into a nationwide problem. It serves as a key reminder of how human factors can be exploited to infiltrate banks and payment systems.

The new era of financial security demands rigorous monitoring not only of systems and software — but also of people.
Read 'Zamin' on Telegram!