Police in the Brazilian state of Santa Catarina say they have carried out the country’s largest law enforcement seizure of cryptocurrency held in self-custody wallets, recovering more than $1.7 million during an investigation into a phishing group.
The seizure was tied to Operation ClickFix, an enforcement action aimed at suspects accused of using social engineering and malware to compromise victims’ devices. Authorities said the recovered assets were transferred into police custody after investigators located and analyzed wallet credentials during the operation.
Operation ClickFix targeted phishing and malware activity
The Civil Police of Santa Catarina disclosed the results of Operation ClickFix on Wednesday, describing it as a major action against a criminal group that allegedly tricked users into installing malicious software. According to police, the scheme relied on fake browser error messages that pushed victims to enter malicious commands into the operating system terminal.
Investigators said that process gave the attackers full control over infected devices. Police added that the malware affected sensitive institutions, including Brazilian public agencies, the police force, and judicial systems, as well as companies tied to the country’s supply chain.
Searches, arrests and asset freezes
The operation itself was executed on September 10. Police said it involved 17 search-and-seizure warrants and two arrest warrants targeting the heads of the group under investigation.
In addition to the cryptocurrency recovery, authorities reported the seizure of more than $1 million in urban properties and the freezing of nearly $18.5 million held in bank accounts linked to the alleged scheme.
How the crypto seizure was carried out
Eduardo Graebin, a detective with the Cybercrime Repression Police Station under the State Directorate of Criminal Investigations, said the case marked the largest seizure of its kind ever recorded among Brazil’s Civil Police forces. The key challenge, he indicated, was that the assets were stored in self-custody wallets rather than with a third-party service provider.
According to Graebin, investigators found four seed phrases during the operation. Police then imported and examined the wallets to determine what assets they contained before moving the funds into the Santa Catarina Civil Police institutional account on Foxbit.
Authorities said Chainalysis provided tools that helped identify the assets. In total, more than $1.7 million in cryptocurrency was transferred in 13 transactions and placed under police control.
Part of a broader enforcement push
Santa Catarina police presented the result as an example of how technical expertise and blockchain analysis tools can affect whether digital assets tied to alleged criminal conduct are successfully located and seized.
Operation ClickFix follows other recent Brazilian cases involving crypto. In April, authorities arrested two well-known singers as part of Operation Narco Fluxo, which was linked to an alleged $320 million crypto money-laundering network. In July, Brazil’s Federal Police also said they dismantled an international trafficking group that moved more than 6.5 tons of cocaine to Europe and used shell companies to launder money with cryptocurrency.
For now, the confirmed next step is that the seized crypto remains in the custody of the Santa Catarina Civil Police through its institutional account, while the wider case against the suspects proceeds from the searches, arrests and asset freezes already announced by authorities.
Source: news.bitcoin.com