Brazilian civil police have seized US$1,708,534 in cryptocurrency from self-custody wallets operated by a phishing ring. The Civil Police of Santa Catarina (PCSC) conducted the operation, called Operação ClickFix, on September 10, 2026, and publicly released details between October 7 and 9.
The seizure represents the largest self-custody digital asset recovery made by Brazilian civil police to date. At the time of seizure, the funds were valued at approximately R$8.78 million and were spread across four cryptocurrencies: Bitcoin, Ethereum, TRON, and Tether.
How the seizure was executed
Investigators used blockchain tracing tools from Chainalysis to track the movement of funds across 13 separate transactions. The assets were then transferred into an institutional account at Foxbit, a Brazilian exchange, where they remain under state custody.
During raids, authorities recovered seed phrases that gave them access to the wallets controlled by the group. This enabled them to import the wallets and transfer the assets directly, rather than relying on a court order served to an exchange or financial institution.
Additional funds totaling roughly US$218,000 have been identified in other reports, though how this amount relates to the main seizure figure has not been clarified in official releases.
The broader operation
The cryptocurrency seizure was accompanied by other enforcement actions. The operation resulted in two arrests and the confiscation of luxury vehicles, including a Corvette valued at more than R$1.5 million. Courts also froze bank accounts totaling up to R$93 million and placed another R$5 million in real estate under judicial control.
The phishing ring used the ClickFix social engineering technique, which enables attackers to take over a victim's device and steal credentials. The operation's name derives from this method.
Self-custody seizures and regulatory implications
The case highlights the distinction between seizing funds held at exchanges and those in self-custody wallets. With self-custody, no intermediary company exists to receive a court order. The PCSC demonstrated the capacity to directly access and move assets from wallets the group controlled, requiring recovery of private key information during physical raids.
The use of institutional infrastructure at Foxbit to hold seized assets and the deployment of Chainalysis tools illustrate evolving approaches by Brazilian investigators to cryptocurrency crime cases.
