InvestIndependently confirmed2 publishers3 min readPublished
Brazilian police took $1.7M from self-custody wallets by finding the seed phrases in raids
Santa Catarina's civil police moved $1.7 million in crypto out of a phishing ring's self-custody wallets, the largest such recovery by Brazilian police. Self-custody left no company to serve with a freeze order. That protection ended once a search found the keys.
The Investor · Invest desk

What happened
- The September 10 operation ran on 17 search-and-seizure orders and two arrest orders against the group's leaders, Bitcoin.com News reported.
- Detective Eduardo Graebin said officers found four seed phrases in the raids, then imported and analyzed each wallet to identify its assets before moving them.
- The funds left the group's wallets in 13 separate transactions, which investigators followed and confirmed with Chainalysis tracing tools.
- Courts ordered freezes on bank accounts of up to R$93 million, and a further R$5 million of real estate was caught up in the judicial measures.
- Cryptobriefing says other reports have identified roughly $218,000 in additional funds, and the released material has not explained how that sum relates to the main figure.
Why it matters
- exposure A seed phrase stored where a search can reach it gives police the same power over a self-custody wallet that a court order gives them over an exchange account.
- precedent Other Brazilian forces now have a worked sequence to copy: seize phrases, import wallets, identify assets with Chainalysis tools, and park the proceeds at a domestic exchange.
- exposure With Foxbit holding state-seized assets, the recovery depends on a private exchange's security until courts settle what happens to the coins.
Divided across four seed phrases, the haul comes to about $427,000 a phrase, and the 13 transfers averaged roughly $131,000 each [17][18]. Cryptobriefing notes that police usually freeze crypto by serving a court order on the exchange that holds it, and that self-custody leaves no company to receive one [12]. Santa Catarina's officers had the phrases, so they could sign the transfers themselves [8].
In our view, the case shows that self-custody closed one route to the coins and left another open. The ring's setup did block the court-order route. A search warrant got to the same coins through the seed phrases. The counter-case is that blockchain analytics did the hard part, and Bitcoin.com News says Chainalysis supplied tools to help identify the assets [10]. Tracing finds coins, but only a key can sign for them. Graebin credited both skill and software. "This result demonstrates, in a concrete way, how specialized technical knowledge and the use of appropriate tools can represent the difference between locating or failing to seize more than one million reais in assets related to criminal activity," he said [13]. Evidence that police moved funds from a wallet whose phrase they never found would prove us wrong, and neither report describes such a transfer.
The roughly $218,000 flagged in other reports could supply that test [20]. Added to the main figure, it would lift the recovery to about $1.93 million [21]. Or it may sit at addresses investigators traced and could not open.
Next to the rest of the operation, the crypto is the smaller pot. R$8.78 million is about 9% of the up to R$93 million that courts froze in bank accounts [15]. At the R$5.14 per dollar implied by the crypto conversion, R$93 million is about $18.1 million, close to the nearly $18.5 million Bitcoin.com News reported [16][2]. The larger pot, roughly ten times the crypto, sat in bank accounts, where a court order could be served on the bank [1][12].
Santa Catarina's police did not set up their own custody for the coins. They went to an institutional account at Foxbit, a Brazilian exchange, so an intermediary of the kind the ring avoided now holds the proceeds for the state [6]. One way this develops is as a one-off that depended on a ring keeping its phrases where a raid could find them. Another is a template other Brazilian forces copy, with Chainalysis to find the assets and an exchange to store them. The third runs through policy. Cryptobriefing, citing research findings, frames the seizure as a sign of growing scrutiny of self-custody wallets [19]. Finance minister Fernando Haddad has said the government is preparing a regulatory overhaul aimed at criminal use of crypto, Bitcoin.com News reported [14]. We'd expect the template, since every step Graebin described is open to any force that finds the phrases [8].
What to watch
- Whether the roughly $218,000 is folded into the official tally or turns out to sit in wallets police traced but could not open.
- What courts decide for the coins held in Foxbit's institutional account, and how long they stay there.
- The text of the regulatory overhaul Haddad has described, and whether it reaches self-custody wallets directly.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Insufficient
- Hype gap+15
- Incentives40
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Courts ordered freezes on bank accounts totaling up to R$93 million; another R$5 million in real estate was caught up in the judicial measures.
ReportedSupportedSource: Cryptobriefing3 sources— create a free account to open themView cited source - [2]
The operation resulted in the freezing of nearly $18.5 million in bank accounts linked to the group.
ReportedSupportedSource: Bitcoin.com News3 sources— create a free account to open themView cited source - [3]
The Civil Police of Santa Catarina seized US$1,708,534 in crypto from self-custody wallets linked to a phishing ring during Operacao ClickFix, carried out on September 10, 2026.
ReportedSupportedSource: Cryptobriefing2 sources— create a free account to open themView cited source - [4]
It is the largest self-custody digital asset recovery Brazilian civil police have made to date.
ReportedSupportedSource: Cryptobriefing; also Bitcoin.com News2 sources— create a free account to open themView cited source - [5]
The funds moved out of the group's wallets in 13 separate transactions; investigators relied on Chainalysis blockchain tracing tools to follow and confirm the transfers.
ReportedSupportedSource: Cryptobriefing2 sources— create a free account to open themView cited source - [6]
The assets landed in an institutional account at Foxbit, a Brazilian exchange, where they sit under state custody; the state leaned on a domestic exchange's institutional infrastructure to hold them.
ReportedSupportedSource: Cryptobriefing2 sources— create a free account to open themView cited source - [7]
The operation produced two arrests and the seizure of luxury vehicles, among them a Corvette valued at more than R$1.5 million.
ReportedSupportedSource: Cryptobriefing2 sources— create a free account to open themView cited source - [8]
Detective Eduardo Graebin said police located four seed phrases during the operation and it was necessary to import and analyze the wallets to identify the assets in each one and transfer the funds to the Santa Catarina Civil Police institutional account on Foxbit.
ReportedSupportedSource: Bitcoin.com News, reporting Graebin2 sources— create a free account to open themView cited source - [9]
The operation, executed on September 10, involved 17 search-and-seizure orders and two arrest orders against the group's heads.
ReportedSupportedSource: Bitcoin.com News2 sources— create a free account to open themView cited source - [10]
In partnership with Chainalysis, which provided tools to help identify the assets, over $1.7 million in crypto was moved in 13 operations and placed under police custody.
ReportedSupportedSource: Bitcoin.com News2 sources— create a free account to open themView cited source - [11]
The haul was worth approximately R$8.78 million at the time of the seizure and spread across Bitcoin, Ethereum, TRON and Tether.
- [12]
When police want to freeze funds on an exchange they can serve a court order on that company; with self-custody no company sits in the middle to receive the order, making recovery considerably harder.
- [13]
"This result demonstrates, in a concrete way, how specialized technical knowledge and the use of appropriate tools can represent the difference between locating or failing to seize more than one million reais in assets related to criminal activity," Graebin said.
- [14]
Fernando Haddad, Brazil's Minister of Finance, said the government is preparing a regulatory overhaul to attack the use of cryptocurrency by organized crime.
- [15]
The R$8.78 million crypto haul equals about 9% of the up to R$93 million in frozen bank accounts; the bank freezes are about 10.6 times the crypto.
- [16]
The crypto conversion implies about R$5.14 per dollar, which puts R$93 million at about $18.1 million, close to the nearly $18.5 million Bitcoin.com News reported.
- [17]
The seizure averages about $427,000 per seed phrase.
- [18]
The 13 transfers averaged about $131,000 each.
- [19]
Research findings frame the seizure as a sign of increasing regulatory scrutiny over self-custody wallets.
ReportedInsufficientSource: Cryptobriefing, citing research findings2 sources— create a free account to open themView cited source - [20]
Other reports have identified roughly US$218,000 in additional funds; how that amount fits alongside the main seizure figure has not been laid out in the material released so far.
- [21]
If the roughly $218,000 is an additional seizure, the total recovery would be about $1.93 million.
Sources
2 independent publishers whose own reporting we read for this story.
- cryptobriefing.comBrazilian police seize $1.7M in crypto from phishing ring’s wallets
1 article · October 9, 2026
- news.bitcoin.comBrazil Seizes Record Crypto Funds From Self-Custody Wallets
1 article · October 9, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Crypto asset seizure and forfeitureFollow
- Blockchain forensicsFollow
- Self-Custody WalletsFollow
- PhishingFollow