Investor had to pay for the ransom of his wife who had been held by kidnappers in captivity, while he had a gun to his head until he released the funds; kidnappers were targets of a national operation
In a dispute still open, expert analysis confirms that bitcoins stolen from the investor's Trezor arrived on the platform (Reproduction)
A case that has been unfolding in the Brazilian court since 2022 gained a new episode with an expert analysis carried out in recent days at the request of an investor who had been the target of kidnapping in the city of Ribeirão Preto (SP). On that occasion, the kidnappers pressured the victim to reveal the private key of his Trezor wallet with 15 bitcoins deposited in it, valued at just over R$ 2 million at the time (R$ 8.5 million today), and then drained the entire amount to an address under their control, in a single transaction.
Kidnappers who held a bitcoin investor captive stole funds from his Trezor in just one transaction, paying only $2 as a mining fee to move millions of reais (Reproduction).
And part of the amounts may have gone to Binance and another to Bitso, according to the investor who is suing the first exchange.
According to the expert analysis, Binance received part of the transactions from the suspicious accounts, and after that there are no more traces of funds withdrawn to the known addresses of the criminals.
For the lawyer who defends the kidnapping victim, this indicates that Binance allowed the funds to flow through the platform, even with the owner of the funds warning about the theft, proving ownership, and showing the addresses. The exchange declined to comment on the specific case (read notes from both parties below).
Technical expert noticed several techniques of money laundering and concealment to hinder the tracking of stolen bitcoins
When starting the analysis of the case, the technical expert appointed by the court declared that the criminals used several transition addresses, that is, used temporarily for money laundering. After that, they scaled the 15 stolen bitcoins in several transactions of smaller amounts, using the techniques called layering and smurfing.
The expert also indicated that the kidnappers showed knowledge in the manipulation of bitcoin addresses, which do not record previous or subsequent activities to the robbery.
“Given the technical analysis carried out, it is evident that the movement of 15.08322957 BTC, extracted from the victim's wallet, followed a flow that perfectly fits the known patterns of cybercrimes involving crypto assets.
The rapid fractionation, use of multiple wallets, sequential temporal movements, and the absence of reuse of addresses after receipt point to deliberate obfuscation techniques, strongly characterizing the use of methods such as smurfing, layering, and possibly the use of mixers or routing services.
In addition, the addresses indicated by the author as being from Binance and Bitso have a graphic and behavioral structure compatible with institutional exchange wallets, corroborating the plausibility that the diverted assets may have reached them“, concluded the expert analysis.
Binance does not comment on cases in court, but says it has reinforced security measures
Contacted by Livecoins, Binance stated that it does not comment on cases in progress in court. However, the exchange stated that it has reinforced its security measures.
“Binance does not comment on ongoing investigations, but reinforces that security is a priority and that it has one of the most comprehensive compliance and security programs
robust in the sector and makes continuous investments to strengthen the protection of the
users and their resources, with the adoption of cutting-edge technology and partnerships with the
most renowned cybersecurity companies and technology providers
of the blockchain space. In 2024 alone, Binance prevented potential losses of
US$ 4.2 billion for 2.8 million users.
Binance also dedicates constant efforts to user education, in
all its communication channels, disseminating good practices and tools
for account protection. Among them:
KYC (or identity verification), requirement for all users;
Two-factor authentication (biometrics and security keys, authentication application, email and phone number);
List of authorized devices;
Management of withdrawal addresses (listing the addresses authorized to receive transfers);
Constant updates to the application with new security elements.“
What does the investor's defense say in the case?
In a conversation with the report, the cryptocurrency expert lawyer Raphael Souza said that the exchange did not pay attention to the investor's alert, allowing criminals to operate freely on the platform.
“The victim warned, proved the ownership of the crypto assets, and yet the exchange ignored the alert. The result? Stolen assets after a kidnapping ended up being moved within the platform itself. Receiving money from crime and continuing to operate as if nothing had happened is assuming legal risk — and the responsibility to compensate the victim comes with it,” said Souza.
Despite the recent technical expertise in the case favorable to the client, the dispute between the kidnapped investor and Binance remains open in the São Paulo court.
However, a recent jurisprudence of the STJ determined in a dispute involving Mercado Bitcoin that Brazilian exchanges are responsible for damages to customers.
Kidnapping gained special operation from the Civil Police of São Paulo in several states
Despite trying to avoid the tracking of bitcoin in the wallets, the criminals were not long in being identified by the authorities. Thus, the Civil Police of São Paulo launched Operation Kirvem in November 2022, a few months after the criminal action.
The operation involved the participation of 50 agents, who acted in Ceará, Maranhão, Tocantins and São Paulo, in a coordinated manner.
Finally, Livecoins reported that it all started with the kidnapping of the investor's wife who was at the supermarket with friends. The case is one of the most emblematic that has occurred in Brazil, since the criminals already knew the model of the investor's wallet before the action.