EUR30M Commerzbank Fraud Traced to Vendor Bug, Four Arrested in Brazil
A software flaw at a payment contractor allowed criminals to drain approximately 30 million euros from customer accounts at Germany’s Commerzbank over the course of just four days. The stolen funds were laundered through a network of intermediaries and financial services, with the bulk of the money cashed out in Brazil. The resulting investigation spanned nearly three years and ultimately led to four arrests in Brazil, along with criminal proceedings against three additional suspects in Europe.
A Vendor Bug Opened the Door in November 2023
The unauthorized transactions took place in November 2023. Criminals exploited a vulnerability, as confirmed by Germany’s Federal Criminal Police Office (BKA), that emerged following a faulty software update at the company handling payment and transaction processing for the affected financial institution. The flaw allowed attackers to initiate unauthorized direct debits from bank accounts. Over the span of a few days, the perpetrators executed numerous fraudulent transactions through the accounts of German online banking customers.
German and Brazilian law enforcement authorities did not officially disclose the name of the affected financial institution, though Brazilian media outlets identified it as Commerzbank. The bank itself confirmed the fraudulent withdrawals and attributed them to technical issues at a third-party service provider. As a result, Commerzbank customers did not lose their own money – the bank absorbed the losses and cooperated fully with the investigation.
A Complex Laundering Chain Across Borders
Following the initial theft, the perpetrators did not simply transfer the entire sum directly into a handful of controlled accounts. Investigators uncovered a considerably more elaborate chain designed specifically to obscure the money’s origin. Funds were routed through transit bank accounts, shell companies, and payment service providers, funneled through platforms handling virtual asset transactions, and ultimately withdrawn using payment cards.
Some of these cards were issued using stolen identities, without the knowledge or consent of the individuals whose personal data was used. This structure allowed the stolen funds to be distributed across a large number of accounts and recipients, repeatedly change form, and become significantly harder to trace as they moved through the system.
Brazil Emerges as the Cash-Out Hub
The majority of the stolen 30 million euros was ultimately cashed out in Brazil, while a smaller portion passed through four European countries. Investigators identified three additional suspects located in Europe, whose criminal cases will be pursued by law enforcement authorities in Spain and Bulgaria.
Operation Klonen: 21 Search Warrants, Four Arrests
On August 14, 2026, Brazil’s Federal Police, supported by Germany’s BKA, carried out Operation Klonen. Law enforcement officers executed 21 search and seizure warrants across seven Brazilian cities.
Four suspects were detained under pretrial detention orders, with arrests carried out in Rio de Janeiro, Guarulhos, Goiania, and Carapicuiba. A Brazilian federal court simultaneously ordered the seizure of financial assets, vehicles, and real estate valued at up to 106 million Brazilian reais – approximately $22.4 million.
A Political Connection Emerges
The investigation also uncovered a link between the stolen funds and Brazilian politics. One of the suspects had run for elected office in 2024. According to Brazil’s Federal Police, this individual directed a portion of the illegally obtained funds toward financing his own election campaign.
Those detained in Brazil face charges of aggravated theft through electronic fraud, participation in a criminal organization, and money laundering. The European portion of the investigation will continue separately in Spain and Bulgaria, where authorities will pursue the three additional identified suspects.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
