Crypto scams: 7 most common in Brazil and how to spot them

Crypto scams took in about US$ 17 billion worldwide in 2025, according to the Chainalysis report published on January 13, 2026, and the average payment per victim rose from US$ 782 to US$ 2,764 in a single year. In Brazil, the Federal Police's Operação Profeta, announced on November 7, 2024, documented R$ 260 million in losses to about 10,000 investors in one scheme. Nearly every case follows one of seven scripts, and each has a warning sign that shows before the money leaves.

In short

• A promise of fixed returns in crypto is the first red flag; no volatile asset pays guaranteed income.
• Verify before paying: CVM registration, Central Bank authorization and the company's CNPJ at the Receita Federal.
• If you were hit, the clock is running: police report, bank dispute and the Pix refund mechanism within 80 days.

The 7 most common scams in Brazil

The first four account for most of the volume. Impersonation scams, in which the criminal poses as a company or an authority, grew 1,400% in 2025, according to Chainalysis. The FBI's 2025 internet crime report, released in April 2026, logged US$ 8.6 billion in crypto-related fraud and 2,686 complaints from Brazil, among the 20 foreign countries with the most filings.

How to verify a company before paying

Advisory, portfolio management and distribution of securities require registration with the CVM, Brazil's securities regulator. The CVM's registry of regulated entities shows who is registered, and the agency's alerts page lists companies and individuals operating irregularly. Plain crypto is not a security, but anyone offering a "managed portfolio" or a "yield contract" in crypto falls under the rule.

Crypto exchanges and custodians need authorization from Brazil's Central Bank as of February 2, 2026, with a transition deadline of October 30, 2026 for companies already operating. The public lookup is Encontre uma instituição on the Central Bank's site, but as of September 30, 2026 it did not yet have a category for virtual asset providers; the first authorizations come after the filing deadline. Until then, check whether the company states its filing number and whether its CNPJ is active with the Receita Federal.

The CNPJ is the third filter. At the Receita Federal, check that the company exists, for how long, with what registered activity and at what address. A company opened three months ago, with R$ 1,000 in capital and a virtual office address, should not receive your money.

What a regulated advisor never does

A securities advisory firm registered with the CVM never holds custody of the assets, which stay in the client's name at the institutions the client chooses, and never promises a return. It also never asks for the seed or the private key, and never charges a "release fee" to withdraw.

Vault Capital is a securities advisory firm authorized by the CVM under Resolução CVM nº 19/2021, and never takes custody of client assets. A company with a similar name, VaultX Capital Ltda, has no relationship with Vault. The official website is vaultcapital.com.br, including its subdomains, and the official channels, CNPJ and registration are on the compliance and regulation page. Before talking to anyone claiming to represent Vault, compare the phone number and email with those listed there.

What to do if you were already hit

File a police report, in person or online, with screenshots, wallet addresses and transaction hashes. Banks and exchanges require it for any freeze attempt.

If you paid by Pix, contact the bank the same day and request the Mecanismo Especial de Devolução, the Pix refund mechanism. It can be requested up to 80 days after the transaction and only returns what is still in the recipient's account, which is why speed matters. Credit card payments can be disputed; a crypto transfer to the scammer's wallet has no reversal, and the only option is to ask the receiving exchange to freeze the address.

File complaints at consumidor.gov.br and Reclame Aqui against the company, if it has a CNPJ. Report to the CVM if an investment was offered, and to the Central Bank if the company presented itself as an exchange. Distrust anyone who shows up later offering to recover the money; that is round two of the same scam. If the problem is lost access rather than theft, the path is different and is covered in lost access to your crypto wallet: what to do.

Crypto assets carry high risk, including significant volatility and the possibility of losing the invested capital. This article is educational and is not investment advice.

Frequently asked questions

How do I know if a crypto exchange is trustworthy?

Check its authorization on the Central Bank's site, its CNPJ at the Receita Federal and its open complaints. An exchange that promises fixed yield on your balance or blocks withdrawals pending a fee is not an exchange.

Can a crypto advisor receive my money?

No. With an advisor registered with the CVM, the money and the assets always stay in your name, at the institutions and wallets you choose. Anyone asking for a transfer to a third party's account or wallet is outside the rules.

Can crypto sent to a scammer be recovered?

Rarely. Blockchain transactions have no chargeback. What exists is a freeze at the receiving exchange, while the funds are still there, and a police investigation based on the report.

Someone contacted me claiming to be from Vault Capital. What now?

Compare the phone number and email with the channels on the compliance page. Vault has no relationship with VaultX Capital Ltda and does not approach people through Telegram or WhatsApp groups.

Let's talk

If you received an offer and cannot tell whether it is serious, a second opinion from a registered crypto advisory costs less than any scam. In the free, no-commitment first conversation, a Vault advisor looks at your case with you, and your assets always stay in your name.