Brazilian authorities have demonstrated advanced capabilities in recovering cryptocurrency from self-custody wallets, a significant development in the ongoing efforts to combat digital asset crime. The Civil Police of Santa Catarina (PCSC), as part of Operação ClickFix, seized over $1.7 million in various cryptocurrencies from self-custody wallets linked to a phishing operation. This operation highlights law enforcement’s evolving strategies in tackling assets held outside traditional financial institutions.
Evolving Enforcement Capabilities
The seizure, which occurred on September 10, 2026, involved approximately $1,708,534 (R$8.78 million at the time) in Bitcoin (BTC), Ethereum (ETH), TRON (TRX), and Tether (USDT). Authorities released details of the operation between October 7 and 9, 2026. The funds were moved in 13 separate transactions and tracked using blockchain tracing tools from Chainalysis. This technical approach allowed investigators to follow the transfers and ultimately move the seized assets to an institutional account at Foxbit, a Brazilian exchange, where they are now held under state control.
Recovering assets from self-custody wallets presents a unique challenge for law enforcement. Unlike funds held on exchanges, where authorities can issue court orders to freeze accounts, self-custody wallets mean the owner directly holds the private keys, with no intermediary. This makes tracing and seizing such assets considerably more difficult. However, in this case, PCSC recovered seed phrases during raids, demonstrating their capacity to import wallets and analyze blockchain data, enabling controlled asset transfers.
Broader Criminal Context and Asset Recovery
The crypto seizure was part of a broader law enforcement effort against a phishing ring. The operation resulted in two arrests and the seizure of other assets, including luxury vehicles, such as a Corvette valued at over R$1.5 million, and R$5 million in real estate. Courts also ordered freezes on bank accounts totaling up to R$93 million. While the primary seizure involved over $1.7 million in crypto, additional funds totaling approximately $218,000 were identified, though their exact relation to the main seizure remains unclear.
Implications for Self-Custody and Regulation
The use of Chainalysis tooling and the subsequent transfer of seized assets to a domestic exchange like Foxbit indicates an emerging pattern in Brazilian enforcement strategies. This approach leverages specialized technology for tracking and utilizes established financial infrastructure for secure storage of recovered digital assets. According to the research findings, this operation is considered a significant self-custody digital asset recovery made by Brazilian civil police.
Authorities released the details publicly, emphasizing that the wallets were allegedly tied to a criminal operation and not a general action against ordinary crypto holders. The case may serve to raise awareness about phishing schemes and encourage investors to strengthen their digital defenses. The research findings frame this operation as a sign of increasing regulatory scrutiny and evolving enforcement capabilities concerning self-custody wallets.
Uncertainties remain regarding the final disposition of the assets held in the Foxbit account and how the additional identified funds will be accounted for. Nevertheless, the operation underscores law enforcement’s growing capacity to navigate the complexities of digital asset recovery in the self-custody space.
Broader Context
In a self-custody wallet, the owner holds the private keys directly, with no exchange or bank acting as middleman.
