Behind a front market in the Lins Complex, in Rio's North Zone, about thirty computers lined up on shelves hummed day and night in a room of an apparently abandoned property. They weren't from a startup. They belonged to the Red Command — and they mined Bitcoin using electricity stolen from the public grid. The Civil Police raided the operation on May 22, during Operation Containment, and revealed live what Chainalysis had been warning about in the abstract: Brazilian organized crime has stopped merely using crypto. Now it manufactures it.
The detail that transforms the seizure into a major issue isn't the farm itself — it's the model. A faction that controls drug trafficking territory set up a production line that converts stolen public infrastructure (electricity) directly into a borderless digital asset that's hard to confiscate. It's light theft becoming blockchain. And it's a vector that completely escapes the regulatory wall Brazil erected in 2026 against stablecoins and payments.
The farm behind the market
The operation was conducted by the Organized Crime Repression and Special Inquiries Unit (Draco) together with the 26th DP (Todos os Santos), targeting the Red Command's territorial control in the Lins Complex. The numbers from the clandestine structure:
- ~30 computers dedicated to mining, lined up on shelves inside a room using a market as a front;
- ~45 kW of consumption (about 32,400 kWh per month), drained through improvised and irregular electrical connections — an industrial light theft;
- ~US$ 6,400 per month in electricity stolen from the public grid (at US$ 0.20/kWh), meaning zero operational cost for the faction;
- 10 suspects arrested, including Emanuel dos Santos Carvalho, known as "Laughing Killer," identified as one of the faction's coordinators in the territory.
The investigation is being conducted for money laundering. And it wasn't an isolated case of "someone mining on the hill": the structure was integrated into the financial machinery of one of the country's two largest criminal organizations.
The new model: stolen electricity becomes clean asset at the source
To understand why this matters, you need to separate mining from traditional money laundering. When a faction launders money, it starts with a dirty value and tries to "clean" the origin. Here the game is different: the faction starts with a stolen input — electricity from the public grid — and transforms it, through mining, into newly-issued Bitcoin, which arrives without a transaction history tied to an underlying crime. The asset reaches the wallet already "clean," without needing to go through a mixer or a bridge.
The math is brutally efficient. With electricity — the biggest cost of any mining — coming for free at the utility company's expense, the margin is practically total. The faction monetizes territorial control (which allows light theft without oversight) and converts it into crypto earnings, outside the banking system, outside Pix, outside the reach of immediate legal seizure. It's the verticalization of crime: territory becomes a power plant, the plant becomes digital asset.
It's not the first time police have chased criminal factions' on-chain money — the Federal Police itself has already blocked R$ 934 million in a crypto laundering operation. The novelty of Lins is the earlier stage: it's not just moving the money, it's producing it.
It's not just mining: full-stack crime
Operation Containment didn't stop at the farm. The same operation hit the financial core of the "fake call center" scam, structured in partnership with investigators from Piauí. The scheme is well-known and devastating: the group calls the account holder impersonating a bank security employee, claims the account has been compromised, and pressures the victim to dial a call center controlled by the gang, where an operator convinces them to give access codes or transfer their entire balance to shell accounts.
Put the two ends together and the picture becomes clear: the faction operates a complete financial chain. On one side, the fake call center scam drains bank accounts — the same family of fraud we mapped in the GoPix trojan and in the cluster of breaches and Pix scams. On the other, the mining farm generates its own asset. Theft, production, and laundering under the same umbrella — a business model, not amateurism.
Brazil on the crypto crime map
The Lins case is the street-level version of a trend that Chainalysis — ON3X's partner in blockchain analytics — documented in the 2026 Crypto Crime Report: the on-chain illicit landscape stopped being made of lone hackers and now operates with large-scale infrastructure, helping transnational criminal networks acquire assets and launder funds. The seizure in Rio shows this infrastructure embodied in physical hardware, in a favela plot.
The backdrop gives perspective. The Federal Police seized about US$ 14 million in crypto in 2025, and Brazil is Latin America's largest crypto market — accounting for nearly a third of the region's volume and ranking 5th in the global adoption index. Where there's mass adoption, organized crime follows the money. The country that was already dealing with massive data breaches and with an increasingly active cyber-insecurity ecosystem now sees territorial factions entering the digital asset production chain.
The contrast with the other end of the spectrum is worth noting. Abroad, cutting-edge crypto crime is state-sponsored and sophisticated, like North Korea's. Here, it's territorial and analog at the entry — light theft — but digital and global at the exit. And it's not unique to Brazil: the wave of police operations against crypto-crime in Latin America shows the entire region chasing the same phenomenon.
The regulatory blind spot
Here's the irony that connects this case to the country's regulatory moment. In 2026, Brazil concentrated its regulatory firepower on the payment and issuance layer: Resolution 561 removed crypto from currency settlement, 521 put wallets under scrutiny, Bill 4,308 targets stablecoin issuance. Everything focused on how digital money circulates in the formal system.
But the Lins farm doesn't touch any of these tracks. It doesn't issue stablecoins, doesn't settle currency, doesn't go through regulated exchanges at the source. It steals electricity and generates Bitcoin. It's a vector that lives in the blind spot of regulation — the same property blind spot we pointed out when Tether started buying real assets in the country. The frontier the State fortifies is that of formal flows; crime, as always, innovates at the edge nobody is watching. Fighting this is work for police and utilities companies, not central banks.
The ON3X perspective
Three takeaways from this case:
- Brazilian organized crime became a producer, not just a user. Mining with stolen electricity is a new stage: the faction transforms territorial control into digitally clean assets at the source, skipping the riskiest part of laundering. It's the industrialization of crypto crime at the favela scale.
- Theft, production, and laundering now live in the same operation. Operation Containment hit, in one sweep, a mining farm and a financial nucleus of banking fraud. It's no coincidence — it's a vertical financial chain, with crypto serving as the exit layer for money coming in through fraud and light theft.
- Regulation targets flow; crime exploits infrastructure. While 561, 521, and Bill 4,308 tighten around stablecoins and payments, mining via stolen electricity passes under everything. Monetary sovereignty doesn't get solved just at the currency exchange counter — and crypto security in Brazil increasingly goes through the power meter.
Frequently asked questions
What did police find in the Lins Complex?
In Operation Containment, on May 22, 2026, Rio's Civil Police found a clandestine cryptocurrency mining farm with about 30 computers hidden behind a front market, powered by electricity theft (~45 kW, ~US$ 6,400/month), linked to the Red Command. Ten people were arrested.
How does "mining with stolen electricity" work?
Cryptocurrency mining consumes a lot of electricity — it's the biggest operational cost. By pulling power from the public grid through irregular connections (light theft), the faction zeros out that cost and keeps nearly total margins on generated Bitcoin, at the utility company's and other consumers' expense.
Why is this different from traditional money laundering?
In classic laundering, you start with dirty money and try to hide the origin. In mining, the faction starts with a stolen input (electricity) and produces newly-issued Bitcoin, which arrives without direct links to underlying crime on the blockchain — an asset already "clean" in the wallet, without needing mixers.
What is the "fake call center" scam?
It's fraud where criminals call the victim posing as a bank security employee, claim the account has been compromised, and induce them to dial a call center controlled by the gang, where they're convinced to provide access codes or transfer their balance to shell accounts. The same Rio operation hit a nucleus of this scam.