How to Bleed a immediate payment Fintech Dry: When a Credential Becomes an Identity
- Samuel Sabogal
- 3 days ago
- 5 min read
In March 2025, a 48-year-old man left a bar in São Paulo. Someone was waiting for him outside. He knew where the man worked, he knew what he did, and he had an offer. What happened three months later is a step-by-step guide to how to bleed a fintech company dry.
João Nazareno Roque had been an electrician and cable TV technician. At age 42, he began studying technology; a few years later, he was a junior back-end developer at C&M Software, a company that almost no one had heard of but on which half of Brazil’s financial system depended: C&M connects dozens of banks and fintech companies to the Central Bank and to Pix, the world’s most successful instant payment system.
The man at the bar offered him five thousand reales—about nine hundred dollars—for his username and password. The payment arrived in cash, in hundred-real bills, delivered by a motorcycle courier. Two weeks later, the same voice offered him ten thousand more to execute commands within the platform from his own work computer. Roque never met anyone: the instructions came via WhatsApp and a Notion account, and as a precaution, he changed his cell phone every fifteen days. Starting in May, the attackers’ commands ran within C&M. No one saw them.
Four in the morning
On June 30, 2025, around 4:00 a.m., the phone of an executive at BMP, a banking-as-a-service fintech company, rang. On the other end, another bank notified him of a transfer of 18 million reais that had just been withdrawn from his reserve account at the Central Bank. While he was answering the call, more orders were already in progress.
Within hours, the attackers emptied the reserve accounts of at least six financial institutions: 541 million reais confirmed—about 100 million dollars—with some estimates reaching 800 million or more. Part of the money was converted into Bitcoin, Ethereum, and USDT that very morning through OTC desks in the region. It remains, to this day, the largest attack on the Brazilian financial system.
It’s worth pausing to consider a detail that gets lost among the zeros: they didn’t touch the money belonging to
end customers. They emptied the institutions’ reserve accounts—their own money, the funds that back them up with the Central Bank. Fraud against customers can be set aside as a provision; the looting of reserves is simply endured.
The track worked perfectly
And here’s the uncomfortable part: Pix didn’t fail. No one broke its cryptography. Every message authorizing every transfer was technically valid: properly formatted, properly authenticated, accepted. The system did exactly what it was designed to do—settle transactions in seconds, without human review—for anyone who presented the correct credentials. The attackers didn’t pick the lock.
They bought the key. And the key cost fifteen thousand reais. This isn’t a Brazilian anomaly—it’s a systemic issue. In 2016, the Central Bank of Bangladesh lost $81 million in the same way: through valid credentials for its SWIFT terminal. And the malware’s most sophisticated feature wasn’t moving the money, but erasing the trail: it intercepted the confirmations and manipulated the reports coming out of the printer, so that the next morning would look like any other. A decade separates the two cases. The lesson is the same, and it still hasn’t been learned.
A credential that can be copied is not an identity
In an instant payment system, the entity is the one that holds the credential. It doesn’t represent the entity—it replaces it. And a password, an API key, or a certificate whose private key resides in a file or a secret manager all share the same inherent flaw: they can be copied. A copy leaves no trace. No one notices the absence of something that’s still there.
That’s why the C&M case isn’t a story about “missing antivirus software” or “failure to train the employee.” It’s a story about architecture, and it lays three truths on the table.
First: A secure identity is not a secret to be kept, but a key generated within a hardware security module (HSM), signed from within, and with no export capability. “The key never leaves” ceases to be a policy that an insider can violate and becomes a physical property of the system. They bought the password from Roque because the password was for sale; a key that cannot leave the hardware is priceless, because there is no way to hand it over.
Second: a serious operation does not depend on a single person. Roque executed commands alone, for weeks, from his own workstation. With M-of-N cross-checking—where every sensitive operation remains pending until approved by a second operator other than the requester—the attacker no longer needs to bribe an employee: he needs to orchestrate a conspiracy. The cost of the attack increases by orders of magnitude, and every failed attempt leaves a trail.
Third: A serious defense assumes that they will also attack the memory. In Bangladesh, the evidence was editable, and they edited it. A hash-chained log, in which altering, deleting, or reordering any historical entry breaks the chain in a detectable way, makes “covering one’s tracks” the impossible part of the plan.
Colombia Is Already Living in This Movie: immediate payment
Bre-B is already operational, and its architecture is, quite rightly, the same as that of all other payment rails around the world: participants connected via mTLS channels with X.509 certificates, digitally signed ISO 20022 messages, settlement in a maximum of 20 seconds, without human review. It is the correct design immediate payment
And it is, precisely, the design in which the message signature is the only safeguard distinguishing a legitimate order from a forged one, and in which the private key serves as the entity’s identification within the rail.
Whoever possesses it is the entity. It’s also worth looking at how the story played out in Brazil: in September 2025, the Central Bank urgently established a licensing regime for technology providers connecting to the rail system, with security requirements, personally liable directors, and segregation of environments.
The regulation came, as it almost always does, after the incident. In Colombia, it may still come sooner; but for each entity, the question isn’t whether the regulator will tighten the requirements on those who “touch the rails,” but rather which side it wants to be on when that happens: the side that was already compliant, or the side that was at the center of the incident that prompted the regulation.
In the meantime, here are three questions for this week. Where is the private key that represents your organization to Bre-B physically located, and who could copy it without leaving a trace? How many people on your team can, on their own, create, activate, or use cryptographic material? And if someone were to edit your logs tonight, how would you find out tomorrow? If any of these answers made you uncomfortable, you already know how much that discomfort is worth: 15,000 reais for the attack, 541 million for the damage.
The Key You Can't Buy
At Cyte, we build the cryptographic control framework that ensures correct responses are the only possible ones: keys that are generated, stored, and used for signing within an HSM (whether in your cloud or your data center—we don’t manufacture the HSM, we manage it), with no export operations; ISO 20022 signing and verification in fail-closed mode for every order sent to the rail; M-of-N dual control over every sensitive operation, with evidence of each approval; and an unalterable chain of evidence, sealed with classical and post-quantum hybrid signatures, verifiable for decades to come—even by an adversary who hasn’t even turned on their machine yet.
It doesn't process payments. It doesn't handle money. It safeguards the only thing that truly matters in an instant transaction: the identity of your entity, so that no one can buy it on the way out of a bar.
¡In just five minutes, find out how vulnerable your organization is today to what's ahead and receive a preparation timeline tailored to your risk level!
Comments