C&M Software
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2F4asB…utBQSummary
C&M Software (also styled CMSW) is a Brazilian financial technology company authorized by the Banco Central do Brasil to provide connectivity between smaller financial institutions and Brazil's national payment infrastructure, including the PIX instant-payment system. On June 30, 2025, hackers exploited credentials sold by an insider employee to drain approximately R$800 million (roughly USD 140–148 million) from reserve accounts of at least six financial institutions, in what became Brazil's largest recorded banking cyberattack. A portion of the stolen funds—estimated at USD 30–40 million—was subsequently laundered through Latin American OTC desks and crypto exchanges using Bitcoin, Ethereum, and Tether USDT, with on-chain investigator ZachXBT playing a central role in tracing and partially freezing the laundered assets.
Connected Entities
6 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- ZachXBT→mentioned with→Ethereum(70%)
- ZachXBT→mentioned with→Bitcoin(65%)
- ZachXBT→mentioned with→Binance(60%)
- Binance→mentioned with→Tether(60%)
- Binance→mentioned with→Ethereum(65%)
- C&M Software→mentioned with→ZachXBT(70%)
- C&M Software→mentioned with→Bitcoin(70%)
- C&M Software→mentioned with→Tether(70%)
- C&M Software→mentioned with→Binance(70%)
- + 2 more
Timeline(7 events)
March 2025
João Nazareno Roque, a C&M Software IT employee, is allegedly approached outside a São Paulo bar by an unidentified individual who demonstrates knowledge of his employer and begins the social engineering recruitment process.
30 June 2025
Between 12:18 AM and 7:00 AM, attackers use insider credentials and stolen digital certificates to inject fraudulent PIX payment orders into Brazil's SPI, draining an estimated R$800 million (USD 140–148 million) from reserve accounts of at least six financial institutions. The Banco Central orders emergency suspension of C&M's SPB connections.
July 2025
Media disclosure begins. Brazilian courts begin freezing accounts; approximately R$160 million reported recovered in initial freeze actions. ZachXBT begins publicly tracing converted crypto funds.
3 July 2025
João Nazareno Roque arrested by São Paulo Civil Police. He confesses to selling credentials for approximately R$15,000 in two installments and enabling remote system access. Police identify at least four hackers involved.
4 July 2025
CoinDesk reports that hackers laundered USD 30–40 million of the stolen funds through Latin American OTC desks and crypto exchanges using Bitcoin, Ethereum, and Tether USDT. ZachXBT publicly describes his investigation and collaboration with Brazilian law enforcement.
Decision Log
- hash: 9zTVo9jAuqtt3nLqP1fL3VWFH1M3cywgpBEKqPY8jXA2
This investigation is cryptographically anchored to the Solana blockchain (1 event).
model: claude-sonnet
generated: 5/4/2026, 4:05:01 PM
last updated: 8/29/2026, 1:35:52 AM
5 viewsavoid.net — verified advice for a post-truth world