Brazilian authorities recover $1.7M in crypto from phishing group
Brazilian civil police in Santa Catarina seized about $1.7 million in crypto from self-custody wallets linked to a phishing group during Operação ClickFix. The assets, including Bitcoin, Ethereum, TRON, and Tether, were moved in 13 transactions and traced with Chainalysis to an institutional account at Foxbit. The operation also led to two arrests, the seizure of luxury vehicles, and court-ordered freezes on bank accounts and real estate.
Brazilian civil police in Santa Catarina recovered about $1.7 million in digital assets during Operação ClickFix, executed Sept. 10, 2026. The seized holdings included BTC, ETH, TRX, and USDT, moved through 13 transfers and traced with Chainalysis before being placed in a Foxbit institutional account under state control. Authorities described it as their largest self-custody recovery to date.
Investigators recovered seed phrases during raids, enabling controlled transfers from wallets the group allegedly controlled. The operation also yielded two arrests, luxury vehicle seizures including a Corvette worth over R$1.5 million, and court-ordered freezes covering up to R$93 million in bank accounts and R$5 million in real estate.
This case may reassure phishing victims that blockchain tracing and coordinated seizures can recover some stolen funds. It could also prompt crypto holders to adopt stronger security practices, while exchanges and custodians may face greater expectations around compliance and asset handling. At the same time, legitimate self-custody users may watch whether such investigative techniques remain targeted at alleged criminal operations rather than broadening into routine scrutiny.