From break-ins to money laundering: operation dismantles group that attacked ATMs in MT and other states

The action complies with 74 legal measures. Among them 10 preventive arrest warrants, 18 search and seizure warrants, 18 authorizations to access data from electronic devices, 15 breaches of bank secrecy and 13 blocking orders for amounts totaling approximately R$240,000.

The investigations take place in Cuiabá and Rondonópolis, in Mato Grosso, in addition to Joinville, in Santa Catarina, and São Luís, in Maranhão. The operation involves the participation of civil police from the three states and the Federal Highway Police (PRF).

The case began to be investigated after an ATM installed inside a supermarket, in the Praia Grande neighborhood, in Várzea Grande (MT), was invaded in the early hours of January 21, 2026. To open the equipment, the criminals used a thermal lance, an industrial tool capable of cutting resistant materials. Even with the activation of the security mechanism, which releases ink onto the notes to prevent their circulation, the suspects managed to take R$105,000.

From that episode onwards, investigators identified other attacks with similar characteristics. In total, six thefts committed between November 2025 and February 2026 in Cuiabá and Várzea Grande were listed.

According to the investigation, the criminals followed a pattern of action: they made openings in walls, used tarps to hide the light produced during the cuts and used the thermal lance to reach the money stored in the safes.

Investigations showed that the criminal organization was divided into groups, with members responsible for different stages of the scheme. While some participated directly in the break-ins, others took care of removing the security ink from the notes, using technological equipment and distributing the amounts obtained from the thefts. To recover the money, the suspects used specific chemicals and materials to remove the ink embedded in the banknotes.

After this process, the amounts were deposited in small amounts and distributed between different bank accounts. The practice, known as smurfing, consists of splitting financial transactions to make it difficult to trace the origin of the money.

Part of the resources was also sent to third parties, who received deposits into their own accounts. Images from security cameras at financial institutions and other elements gathered during the investigation helped identify those involved in the different phases of criminal activity.

The investigation also revealed that the group was not limited to Mato Grosso. Members who lived mainly in Santa Catarina traveled to the state to participate in the attacks. Investigators also found evidence of the suspects' links to previous criminal activities in Rio de Janeiro and Alagoas.

In addition to the arrests and searches, the Court authorized the blocking of up to R$239,980.52 in accounts and other financial assets of those being investigated. The amount corresponds to the losses calculated in four of the thefts discovered so far. The value may be revised as financial analyzes progress and new losses related to the scheme are identified.