{"id":1058801,"date":"2024-12-26T14:52:56","date_gmt":"2024-12-26T22:52:56","guid":{"rendered":"https:\/\/theaegisalliance.com\/?p=1058801"},"modified":"2026-10-05T08:50:24","modified_gmt":"2026-10-05T15:50:24","slug":"brazilian-hacker-faces-charges-for-extorting-3-2-m-in-bitcoin-following-breach-of-300000-accounts","status":"publish","type":"post","link":"https:\/\/theaegisalliance.com\/fr\/2024\/12\/26\/brazilian-hacker-faces-charges-for-extorting-3-2-m-in-bitcoin-following-breach-of-300000-accounts\/","title":{"rendered":"Newark Indicted Curitiba&rsquo;s Junior Barros De Oliveira for a $3.2 Million Bitcoin Extortion That Brazil&rsquo;s Constitution Will Not Extradite"},"content":{"rendered":"<p><iframe loading=\"lazy\" title=\"Hackers claiming they have video of you and asking for bitcoin? #blackmail #scammer\" width=\"500\" height=\"281\" src=\"https:\/\/www.youtube.com\/embed\/l2mki9RtAUo?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe><\/p>\n<p>A Newark grand jury put a name on a 2020 inbox without putting a defendant on a plane. On December 23, 2024, the U.S. Attorney&rsquo;s Office for the District of New Jersey unsealed an indictment against Junior Barros De Oliveira, then 29, of Curitiba. Prosecutors say that in March 2020 he gained unauthorized access, more than once, to the computers of \u00ab\u00a0Victim 1-Brazil,\u00a0\u00bb the Brazilian subsidiary of a company based in New Jersey, and took confidential records on about 300,000 customers. In September 2020 he began emailing U.S. representatives of the parent, including the chief executive, under an alias. The first demand was roughly 300 bitcoin, about $3.2 million at the prices of that month, to keep the file off the market. The second pitch was dressed as help: about 75 bitcoin, then near $800,000, to \u00ab\u00a0solve\u00a0\u00bb the security flaw he had used, with wallet instructions attached.<\/p>\n<p>The indictment charges four counts of extortionate threats involving information from a protected computer, 18 U.S.C. \u00a7 1030(a)(7)(B), and four counts of interstate threatening communications, 18 U.S.C. \u00a7 875(d). Each computer count carries up to five years in prison and a fine of $250,000, or twice the gain or loss. Each threats count carries up to two years and the same fine math. U.S. Attorney Philip R. Sellinger announced the unsealing. Assistant U.S. Attorney David E. Malagold is on the caption. The <a href=\"https:\/\/www.justice.gov\/usao-nj\/pr\/brazilian-man-charged-making-extortionate-threats-publicize-stolen-data-obtained\" target=\"_blank\" rel=\"noopener\">Justice Department release<\/a> does not say any bitcoin moved, does not name the company, and does not say the 300,000-record file ever appeared on a leak site. De Oliveira is presumed innocent. A charging sheet is not a conviction. No public announcement has described a U.S. arrest, a Brazilian detention, a plea, or a trial date.<\/p>\n<p>The second email is the tell. Extortionists who stay in character as thieves keep selling silence. Extortionists who rebrand as vendors sell a fee to fix the door they kicked. Both asks are still threats under the computer-fraud statute if the government can prove the data came from a protected computer and the demand was tied to a threat to publish. <a href=\"https:\/\/thehackernews.com\/2024\/12\/brazilian-hacker-charged-for-extorting.html\" target=\"_blank\" rel=\"noopener\">The Hacker News<\/a>, Security Affairs, and other incident desks reconstructed the same narrative from the unsealed counts. None of them was handed a victim letter. The AEGIS Alliance will not invent a company name to fill that blank. Naming a firm from a guess would republish a customer file before any jury exists.<\/p>\n<div class=\"embed-x\">\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">$3 Million Bitcoin Ransom: Brazilian Man Charged in US Cyber Extortion <a href=\"https:\/\/t.co\/ntv8yOVdfi\">https:\/\/t.co\/ntv8yOVdfi<\/a><\/p>\n<p>&mdash; Nicolas Krassas (@Dinosn) <a href=\"https:\/\/x.com\/Dinosn\/status\/1872501287620940107?ref_src=twsrc%5Etfw\">December 27, 2024<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.x.com\/widgets.js\" charset=\"utf-8\"><\/script><\/div>\n<\/p>\n<h2>A constitution that does not ship native-born defendants<\/h2>\n<p>The quiet docket has a legal explanation that is stronger than \u00ab\u00a0these things take time.\u00a0\u00bb Article 5, item LI, of Brazil&rsquo;s 1988 Constitution says no Brazilian shall be extradited, except a naturalized Brazilian, and then only for a common crime committed before naturalization or for proven drug trafficking. Native-born citizens sit behind an absolute bar. The Law Library of Congress has noted that Brazilian doctrine treats the protection as something a defendant cannot waive, even if he wanted a U.S. courtroom. The Federal Supreme Court in Bras\u00edlia, not a magistrate in Newark, decides extradition requests. A grand jury vote does not override that text.<\/p>\n<p>That does not make the indictment decorative. It makes it a travel restriction, a mutual-legal-assistance file, and a marker if he ever enters a country that will put him on a plane. Brazilian prosecutors could, in theory, try the same facts at home if U.S. evidence were shared. Nothing in the public record says they have. Cyber cases often stall in exactly this shape: a loud charging headline, a defendant who remains a citizen of a state that will not extradite him, and a press office that never posts a second release. Readers should treat silence as silence, not as a secret acquittal and not as a secret cell.<\/p>\n<p>The four-year gap between the September 2020 emails and the December 2024 unsealing fits the unglamorous work of wallet tracing, treaty requests, and a sealed investigation that prosecutors did not want argued in the press. The release does not confirm which of those happened. Maximums on the caption are stacking math, not a predicted sentence. Eight counts do not automatically become 28 years. Federal judges group overlapping threats. None of that arithmetic matters until there is a defendant in a courtroom. Right now there is a PDF and a city in Paran\u00e1.<\/p>\n<div class=\"embed-x\">\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">A Brazilian hacker has been charged in the U.S. for allegedly extorting $3.2 million in Bitcoin after breaching a company\u2019s network in 2020.<\/p>\n<p>The hacker targeted the Brazilian subsidiary of a New Jersey-based firm, stealing data from around 300,000 customer accounts. <a href=\"https:\/\/t.co\/tD5ETH2vDv\">pic.twitter.com\/tD5ETH2vDv<\/a><\/p>\n<p>&mdash; FUNCSHUN (@funcshun) <a href=\"https:\/\/x.com\/funcshun\/status\/1877354793573703791?ref_src=twsrc%5Etfw\">January 9, 2025<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.x.com\/widgets.js\" charset=\"utf-8\"><\/script><\/div>\n<\/p>\n<h2>Publish-or-pay, priced in a coin that moved<\/h2>\n<p>This is not classic ransomware. The charging language does not describe encrypted servers or a decryption key. The leverage is the customer list and the chief executive&rsquo;s inbox, the older cousin of the double-extortion model crews later industrialized. That model spread in 2020 because remote access was messy and bitcoin rails were liquid. Curitiba to Newark is a short line on a map and a long one in a treaty.<\/p>\n<p>The price of the ask moved even if the coins did not. Three hundred bitcoin meant about $3.2 million when the first email went out, which implies a coin near $10,700. By late September 2026, spot prices reported around $85,000 would put the same 300-coin stack near $25 million, and the 75-coin \u00ab\u00a0consulting\u00a0\u00bb pitch near $6 million. Charging documents freeze the figure at the time of the demand because that is the alleged loss theory. Rewriting the crime at today&rsquo;s ticker is market commentary. It is still the right commentary for a reader trying to understand why a 2020 email still matters: the leverage was a pile of coins whose dollar value refused to sit still, aimed at a company that could not sit still either once customer records were in someone else&rsquo;s hands.<\/p>\n<p>The AEGIS Alliance has covered the same motive with different tools. The <a href=\"https:\/\/theaegisalliance.com\/2024\/08\/25\/ngate-android-malware-steals-nfc-data-clones-no-contact-payment-cards\/\">NGate NFC-relay case<\/a> was about cloning tap-to-pay cards. The <a href=\"https:\/\/theaegisalliance.com\/2025\/12\/17\/shinyhunters-breach-pornhub-premium-data-and-demand-ransom\/\">ShinyHunters ransom demand<\/a> and the <a href=\"https:\/\/theaegisalliance.com\/2025\/12\/17\/inside-the-700credit-breach-that-exposed-nearly-6-million-car-buyers\/\">700Credit breach<\/a> were later versions of a simple idea: take the list, price the list, dare the victim to explain the leak. De Oliveira&rsquo;s alleged method is older and plainer. No hoodie mythology is required. The exhibits, if they are ever walked into court, will be emails, wallet instructions, and server logs from the first months of a work-from-home scramble, when \u00ab\u00a0authorized access\u00a0\u00bb had become a slogan at a lot of foreign subsidiaries.<\/p>\n<h2>What the public record still refuses to show<\/h2>\n<p>There is no photograph of De Oliveira in the Justice Department package. There is no wallet address in the press release. There is no victim-notification letter from a named New Jersey parent that matches this caption. There is no widely reported arraignment minute. Those absences are the story that remains. An indictment without a body is a bookmark. It can still be a true bookmark. Grand juries hear agents. Agents dump logs. Logs show logins. The March 2020 access window sits inside a year when a lot of companies learned their Brazilian offices were on the same network as a headquarters in New Jersey, which is why a crime committed on one side of the equator can be charged on the other.<\/p>\n<p>The short clip embedded above is not a documentary about this defendant. It is a public warning about the adjacent economy in which strangers demand bitcoin under a threat to publish private material. The Newark theory is a corporate version of that lever. Different inbox. Same coin. A network package devoted only to this Curitiba caption has not traveled in a form that belongs in a Classic Editor embed, so the warning clip stays as context rather than as evidence.<\/p>\n<p>Related reading sits on the <a href=\"https:\/\/theaegisalliance.com\/category\/news\/hacker-news\/\">Hacker News<\/a> and <a href=\"https:\/\/theaegisalliance.com\/category\/news\/international-news\/\">International News<\/a> desks. Until the Justice Department or Brazilian federal police announce a person in custody, the accurate last line is the dull one. Junior Barros De Oliveira is a man named in a New Jersey indictment. The Brazilian constitution, for a native-born citizen, is the reason a Newark cell has not been part of that sentence.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A Newark indictment unsealed December 23, 2024, charges Junior Barros De Oliveira of Curitiba with threatening to leak about 300,000 customer records unless he was paid about $3.2 million in bitcoin. Brazil bars extradition of native-born citizens. No U.S. arrest has been announced.<\/p>\n","protected":false},"author":296,"featured_media":1058934,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22,23,21,204522,204504],"tags":[1132,214208,208270,215183,205256,192022,3674,213978,3689,193302,1806],"class_list":["post-1058801","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hacker-news","category-international-news","category-news","category-other-videos","category-videos","tag-bitcoin","tag-brazil","tag-breach","tag-btc","tag-crypto","tag-hacker-news","tag-hackers","tag-money","tag-tech","tag-tech-news","tag-technology"],"jetpack_featured_media_url":"https:\/\/theaegisalliance.com\/wp-content\/uploads\/Brazilian-Hacker-Faces-Charges-for-Extorting-3-2M-in-Bitcoin-Following-Breach-of-300000-Accounts-1.jpg","_links":{"self":[{"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/posts\/1058801","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/users\/296"}],"replies":[{"embeddable":true,"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/comments?post=1058801"}],"version-history":[{"count":5,"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/posts\/1058801\/revisions"}],"predecessor-version":[{"id":1203378,"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/posts\/1058801\/revisions\/1203378"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/media\/1058934"}],"wp:attachment":[{"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/media?parent=1058801"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/categories?post=1058801"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/theaegisalliance.com\/fr\/wp-json\/wp\/v2\/tags?post=1058801"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}