I Paid by Pix and It Became Crypto: Where the MED Ends and the On-Chain Trail Begins

In January, the Civil Police of Rio Grande do Sul launched Operação Mirage against a fake-investment ring that extracted R$ 4,378,000 from a single victim in the state. The police description reads like a map of the route money takes in most of these scams. The victim's capital "was paid in, via Pix transfers, to accounts belonging to various companies," most of them "recently incorporated." The funds were then "rapidly converted into stablecoins and transferred to third parties, hampering tracing." Investigators found more than R$ 7 million in transfers to buy crypto assets on a single day. The courts froze accounts belonging to 85 individuals and companies, along with crypto wallets held in custody by 17 exchanges.

This is the route behind the phrase "I paid by Pix and it became crypto." It has two halves, governed by different rules, and understanding where one ends and the other begins changes what the victim should do first.

The first half: the money is still Pix

While the money is still in reais, in an account that received a Pix transfer, the Mecanismo Especial de Devolução — the MED, Brazil's special refund mechanism — applies. The victim files a dispute in their own bank's app, and the recipient's bank must block the amount in the recipient's account. If the account holds less than the disputed amount, whatever balance exists is blocked, and anything that comes in during the review is blocked as well, up to the amount claimed.

In the current version of the Banco Central guide, the MED does not stop at the first account. In the guide's own words, it allows "the tracing of transactions and blocking of funds suspected of involvement in fraud, not only in the destination account of the original transaction, but also in subsequent transactions." If the fraudster moved the money onward by Pix, to another account and then another, the request can reach those accounts too. We explain here how the deadline for each stage works.

The limit is in the name. The MED traces and blocks funds held in Pix accounts. Once the money leaves the account to buy cryptocurrency, what remains in the account is only what was not spent. In the Mirage case, conversion was fast, and a MED filed the next day may well find an empty account. That is why the MED returns what it finds, not what the victim lost.

Hence the first rule: file the dispute in your bank's app the moment you realize it was a scam, before anything else. Disputes are accepted for transactions up to 80 days old, but the conversion into crypto will not wait.

Where the purchase happens

To become a stablecoin, reais must pass through someone selling cryptocurrency. That may be an exchange, or an individual selling directly on the P2P market. In the Mirage case, the frozen wallets were held in custody at 17 exchanges: the conversion ran through companies that knew the customer making the purchase.

Since February, exchanges operating in Brazil have been entering a Banco Central authorization regime under Resolução BCB nº 520. Several of its rules matter to victims, because they describe what the exchange retains about whoever made the purchase:

• customers' funds in reais must be segregated from the company's own funds, in individualized accounts held in each customer's name (art. 28);
• the exchange must adopt know-your-customer measures (art. 47) and retain transaction records for a minimum of five years (art. 45, II);
• it must identify suspicious transactions and keep those records available to the authorities (art. 45, III);
• and it must set limits and temporary blocks on atypical or suspicious transactions and withdrawals (art. 43, § 2º, VI).

And there is a deadline this week. By 30 October, institutions must also implement fraud-indicator sharing in the provision of virtual asset services (Resolução BCB nº 343, art. 13-A, I, added by Resolução BCB nº 569). It is the same system banks already use to exchange fraud intelligence, now extended to the crypto market.

None of this gives the victim direct access to the purchaser's customer file. What these rules establish is that, when a purchase runs through a regulated exchange, there is a company on the other side obliged to know who its customer is, to keep the record, and to be able to block. The party that requests the block and the data is an authority or a judge, as in Mirage.

The second half: the money became a wallet

After the purchase, the stablecoin leaves the exchange for a wallet, and from there for others. This stretch of the route is public. Anyone can see on-chain where the coin came from, where it went, and how much moved. What the blockchain does not show is the name of whoever controls each wallet.

That is why the thread linking the two halves is the exchange. The wallet that received the coin was funded from an identified customer account, and that is where the investigation recovers a name. The same holds at the far end of the route: when the fraudster tries to turn the coin back into cash, they generally have to pass through another exchange, which also knows its customer.

With stablecoins there is an additional control point that reais do not have. Tether, the issuer of USDT, can freeze addresses in the coin's own contract. It does so at the request of an authority, and the freeze prevents the coin from leaving that address. We've covered what a USDT freeze reaches, and what it does not give back.

What to preserve, and in what order

The Pix receipt shows where the money went in the first half. The wallet address and the transaction identifier — the hash — show where it went in the second. Many victims have the first and lose the second, because the fraudster showed them a dashboard with a "balance" and never an actual on-chain transaction.

• File the Pix dispute in your bank's app, now. Keep the case number.
• Keep every Pix receipt, with the name and bank of the recipient. A recently incorporated company receiving large sums is one of the red flags the police described in Mirage.
• Look for any wallet address or hash the fraudster sent you: a "deposit address," a transaction screenshot, a link to a "receipt" on a blockchain explorer. Export the entire conversation, not just screenshots.
• File a police report with all of it attached. The bank cannot require a police report to open a MED, but it is the report that takes the case to whoever can demand data and blocks from the exchange.

A disclosure about us

CyberX works with scam victims, which is why this section is flagged and kept separate. The crypto wallet lookup is free and requires no sign-up: it shows a wallet's network, age, and activity, and the preliminary report arrives by email with a case number and hash that anyone can verify at cyberx.to/verificar. When a case calls for more, CyberX responds with a defined scope and a proposal. CyberX does not recover funds and is not an authority. What it delivers is documentation of the route, for those who can act on it. Be wary of anyone promising more than that — including anyone using our name.

In one line

The MED follows your money while it is still reais in a Pix account. Once it becomes crypto, the thread runs through the exchange that sold the coin, and only an authority can pull it — using the receipt and the address you preserved.

Sources

• Polícia Civil do Rio Grande do Sul — Operação Mirage mira organização criminosa especializada em golpes de falsos investimentos (13/01/2026)
• Banco Central do Brasil — Guia de implementação dos procedimentos de devolução no Pix, com ênfase no Mecanismo Especial de Devolução, versão 4.4, glossary ("Recuperação de Valores") and section 4.2.4
• Banco Central do Brasil — Resolução BCB nº 520, de 10 de novembro de 2025, arts. 28, 43, 45 and 47
• Banco Central do Brasil — Resolução BCB nº 569, de 19 de maio de 2026, which adds art. 13-A to Resolução BCB nº 343
• CyberX — No relógio do MED, o único prazo que solta o dinheiro é o do banco da vítima, O MED não devolveu o seu dinheiro and A Tether pode congelar USDT