Brazilian police seize $1.7M in crypto from phishing ring’s wallets

Brazilian police have pulled US$1,708,534 in crypto out of self-custody wallets linked to a phishing ring. The Civil Police of Santa Catarina (PCSC) seized the funds during Operação ClickFix, which it carried out on September 10, 2026.

It is the largest self-custody digital asset recovery Brazilian civil police have made to date.

What police actually took

The haul was worth approximately R$8.78 million at the time of the seizure. It spread across four assets: Bitcoin (BTC), Ethereum (ETH), TRON (TRX) and Tether (USDT).

Authorities released the details publicly between October 7 and 9, 2026, roughly a month after the operation itself.

The funds moved out of the group’s wallets in 13 separate transactions. Investigators relied on blockchain tracing tools from Chainalysis to follow and confirm the transfers.

The assets then landed in an institutional account at Foxbit, a Brazilian exchange, where they now sit under state custody.

Other reports have identified roughly US$218,000 in additional funds. How that amount fits alongside the main seizure figure has not been laid out in the material released so far.

Corvettes, frozen accounts and a phishing playbook

The crypto was only one piece of a larger takedown. The operation produced two arrests and the seizure of luxury vehicles, among them a Corvette valued at more than R$1.5 million.

Courts also ordered freezes on bank accounts totaling up to R$93 million. Another R$5 million in real estate was caught up in the judicial measures.

The group’s method gave the operation its name. According to the research findings, the ring used the ClickFix social engineering technique, which helps attackers take over a victim’s device and steal credentials.

Why self-custody seizures are a different kind of story

In a self-custody wallet, the owner holds the private keys directly, with no exchange or bank acting as middleman. When police want to freeze funds sitting on an exchange, they can serve a court order on that company. With self-custody, no company sits in the middle to receive the order, which makes recovering assets considerably harder.

PCSC did not simply ask a platform to freeze an account; it moved funds out of wallets the group itself controlled and into a custodial account under state control. Authorities recovered crucial seed phrases during raids and demonstrated their capacity to import wallets and analyze blockchain data, enabling controlled asset transfers.

The use of Chainalysis tooling shows how Brazilian investigators are approaching these cases. The choice of Foxbit as custodian points to another emerging pattern: seized crypto has to be stored somewhere secure, and here the state leaned on a domestic exchange’s institutional infrastructure to hold it.

What this means for crypto users and investors

The research findings frame the seizure as a sign of increasing regulatory scrutiny over self-custody wallets. The wallets in this case were allegedly tied to a criminal operation, and the seizure came alongside arrests and court-ordered freezes, not as a blanket action against ordinary holders.

The findings also note the case may raise awareness of phishing schemes and push investors to strengthen their defenses. Some may look for custodial solutions with stronger security, while others may simply tighten up how they handle their own keys and devices.

Also worth tracking: what ultimately happens to the assets sitting in Foxbit’s institutional account, and whether the roughly US$218,000 flagged in other reports gets folded into the official tally.