Brazilian Police Arrest Man Behind Bitcoin Extortion Bomb Threats

Brazil's Civil Police have arrested Ítalo Francisco Mendes Barbiot, a lone suspect who sent dozens of letters containing real explosive material to financial executives and residents of luxury condominiums in São Paulo, demanding roughly 1.7 million reais — nearly $300,000 — in bitcoin. The letters threatened drone-based attacks loaded with dynamite and C4 unless recipients paid a self-custody Bitcoin wallet whose QR code appeared on each page.

The case, which investigators solved after a lengthy probe, marks one of the more concrete examples of physical-extortion tactics fused with cryptocurrency ransom demands in Brazil. Each letter contained actual explosive components, according to police, elevating the campaign from hoax to credible criminal threat under Brazilian law.

How did the extortion scheme work?

The suspect's letters targeted two groups: financial executives and wealthy residents of luxury São Paulo condominiums. Recipients found death threats describing a planned attack using drones carrying dynamite and C4, together with genuine explosive material enclosed in the envelope.

The letters instructed victims to transfer 1.7 million reais worth of bitcoin — approximately $300,000 — by scanning a QR code linked to a self-custody wallet. The demand, in other words, bypassed exchanges entirely, directing payment to an address the sender controlled directly.

What broke the case for investigators?

Digital trails initially led nowhere definitive. Police attempted to trace the self-custody Bitcoin wallet embedded in the letters and examined email accounts created through a Switzerland-based encryption service, a setup designed to frustrate attribution. Both avenues stalled.

The decisive lead came from the physical world. Investigators traced the suspect's movements through the Brazilian Post Office, reconstructing where the threatening letters entered the system. The identification closed when cameras caught the man paying a subway fare with a digital app on his smartphone, allowing police to name Ítalo Francisco Mendes Barbiot as the sender.

The arrest illustrates a recurring pattern in crypto-linked crime: blockchain forensics alone often cannot unmask a self-custody wallet holder with no exchange footprint, while mundane surveillance — transit payments, postal records — supplies the identity. The same asymmetry has shaped prior cases, from the 2014 trial of Ross Ulbricht, convicted partly on digital evidence tied to Silk Road, to modern ransomware investigations that rely on operational slips rather than chain analysis.

What happens next?

Authorities have not yet publicly detailed the specific charges Barbiot faces or a court date. Brazilian federal law treats extortion and threats involving explosives as serious offenses, and the inclusion of real explosive material in the letters could compound potential sentencing exposure.

For São Paulo's financial community, the case closes a chapter of targeted intimidation that paired old-fashioned letter bombs with modern ransom infrastructure. Prosecutors will now determine whether the case proceeds under state or federal jurisdiction, a decision that typically follows within weeks of an arrest of this kind.