Verified Platforms
Quick Links
Where to Stay Secure
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Searching a platform's name is the one check that cannot come back clean.
Someone drops a name into a WhatsApp group. Bitcoin Treasure, say. Or Bitcoin Fortress, or Bitcoin Omnix. You do the sensible thing and type it into Google with the two words a Brazilian buyer attaches to any name they do not trust yet: Ć© confiĆ”vel. The results load. At the top sits an affiliate review hosted on a hijacked subdomain of somebody's corporate CRM portal. Below it, three listicles about crypto fraud that never mention this platform at all. A fraud-warning page from bitcoin.org. And ranking comfortably in the middle of them, the platform's own website, describing itself as uma opĆ§Ć£o confiĆ”vel.
The clearest answer on the page was written by the party you were asking about.
Lilith spent twenty years in cybersecurity before she left to make NFT art full time and argue about decentralization. Four checks survive that search, and her lens never moves: who holds the keys, what can be forged, and what the forgery would cost to keep up.
She does not begin with red flags. She begins by pricing the checks.
The usual checks are real, and you should run them. You confirm the domain is the one you meant to reach and that the certificate matches it. You turn on two-factor authentication with an app instead of SMS. You look for a stated cold-storage share, read the reviews on Reclame Aqui and Trustpilot, and send a small withdrawal to watch it arrive.
Each of those answers a fair question. None of them is expensive to defeat.
A lookalike domain costs twelve dollars. A valid certificate is free and issues automatically. A cold-storage policy is a paragraph, and a paragraph takes an afternoon. Reviews are a market with published prices. And the small withdrawal, the check that feels most like proof because you watched the money move, is the cheapest thing on the list to honour. Paying out fifty dollars is the marketing expense that buys the five thousand behind it. The pattern is documented in the security field's own guidance, in language nobody has managed to soften: small transactions work, larger ones get stuck.
Lilith's objection is not that these checks are wrong. It is that they all examine the same object.
The domain, the login screen, the published policy, the payout of an amount the platform itself chose to release: every one of those is the interface, and the interface is the part the other side builds on purpose. Kodex has written before about how a dApp frontend becomes the attack surface while the contract underneath stays untouched. The same geometry applies here, one level up. What you are about to send money to is not a website. It is a counterparty, and a counterparty is a company, in a country, with a name that can be looked up.
There is a sharper version of that instinct, and it is worth following. Stop trusting screens. Send a small transfer, take the transaction ID, and confirm it on a block explorer rather than in the platform's own dashboard. The principle underneath it is sound: a service you cannot check from outside is a service you are taking on faith. But the check has a boundary, and the boundary is where the money actually sits. Confirming that a transaction settled on-chain proves the platform moved that transaction. It proves nothing about the balance still resting in its account, the entity holding that balance, or whether anyone is obliged to count it. Execution can be verified from outside. Solvency cannot.
That is what the next four checks are for, and they are ordered deliberately.
Start here because it is free, it takes about four minutes, and the rest of the sequence means very little without it.
Find the CNPJ. A platform selling to Brazilians either publishes one in its footer, its terms of use or its fee schedule, or it does not, and both outcomes tell you something before you have looked anything up. Then take that number to the Receita Federal's public CNPJ lookup and read four fields: the registered corporate name, the situaĆ§Ć£o cadastral, the date the company was opened, and its declared economic activity.
You are not looking for a verdict. You are looking for mismatches, and shells produce them reliably. A company opened eleven weeks ago running a platform that advertises "years of experience". A situaĆ§Ć£o cadastral reading baixada or inapta while the site takes deposits. A declared activity that has nothing to do with financial services. A registered address that turns out, in one more search, to be a virtual office shared by four hundred other companies. Or the quietest one: the trading name in the app is a different legal person from the one that appears on the PIX receipt.
Lilith opens the Receita Federal page before she opens the platform's homepage, and reads the situaĆ§Ć£o cadastral first. "A CNPJ is not a licence and it is not a safety rating," she says. "It is a name with a legal address attached, and a legal address is where a subpoena arrives."
When there is no CNPJ anywhere on the site, the check has not failed. It has returned a different answer. Offshore platforms serve Brazilians without a Brazilian entity all the time, which is lawful in itself and changes what you are exposed to rather than proving anything about intent. Put the same questions to whatever entity does appear: which company, registered where, under which number, and in which country a claim would have to be filed. If no jurisdiction survives that sequence, the decision in front of you has quietly changed shape. You are no longer choosing between platforms. You are deciding whether to send money to a website.
That is precisely why a serious fake avoids this check. Registering a real Brazilian company means naming real partners, accepting a permanent public record, and leaving a paper trail that outlives the website. It is not impossible. It is simply the first thing on this list that costs the other side something it cannot delete later.
Brazil stopped treating this as a grey zone. Lei 14.478/2022 placed virtual asset service providers under the Banco Central's supervision, and in November 2025 the regulator published ResoluĆ§Ć£o BCB nĀŗ 520, in force from 2 February 2026, setting out how such a company becomes authorized to operate at all.
The transition rules matter more than the rule. A platform that was demonstrably operating on 2 February 2026 may keep operating while it applies, and it has until 30 October 2026 simply to file the request. So for the whole of 2026, "we operate legally in Brazil" and "we are authorized by the Banco Central" are two different sentences, and a platform that prefers the first one is not necessarily lying. It is choosing the sentence that is still true.
Then comes the part nobody enjoys. There is no public register of pending applications. You cannot look up whether a given platform filed, which means this check is not a database query but a question, asked in writing and read for specificity.
A company inside the process answers with objects: the legal entity that filed, the approximate date, the resolution it filed under, the activities it applied for. A company outside it answers with adjectives. Regulated. Compliant. Licensed, jurisdiction unnamed. Supervised, supervisor unnamed. Watch for the geography trick too, where a platform holds a registration somewhere permissive and lets you assume it covers the country you are sitting in. Kodex's walkthrough of the SPAV authorization deadline in Brazil covers what the process actually demands of a firm that enters it.
One clause is worth carrying into any answer you get. The rulebook states that contracting a custodian, domestic or foreign, does not transfer or remove the provider's own regulatory responsibility. So "our custody partner is a regulated institution" is not an answer to "are you". Lilith reads that clause as the whole custody question in one line: responsibility does not move just because the coins do.
Proof of reserves arrived in crypto as a public-relations gesture. An exchange would publish a Merkle tree after a competitor collapsed, journalists would write it up, and the practice would fade until the next collapse. Voluntary, timed by the platform, scoped by the platform.
In Brazil that changed on 27 February 2026, when the Banco Central published InstruĆ§Ć£o Normativa BCB nĀŗ 713 and gave the gesture a document number. Document 5710, Provas de Reservas e OperaƧƵes de Staking, requires verifiable proof of reserves broken down by virtual asset, the quantity held in custody on behalf of clients, and the financial value of those positions. Client balances committed to staking are reported inside the same document, which closes the oldest gap in voluntary attestations: the coins that were technically present and technically lent out at the same time. It is computed monthly, on the last day of the month at 23:59 in BrasĆlia, and filed within five business days of that date.
The per-asset breakdown is the part worth slowing down for, because it is exactly what a headline total hides. One aggregate figure in reais lets a shortfall in one token vanish behind a surplus in another, and it lets coins that have been lent out look identical to coins that have not moved. Reporting quantities asset by asset, with client custody separated and staking balances disclosed in the same filing, closes both hiding places at once.
Be careful with the timetable, because it is moving. The start of the reporting obligation was pushed to November 2026, and on 4 August 2026 ABToken, Zetta and ABFintechs wrote jointly to the Banco Central asking for 120 more days across four milestones of the transition. You cannot walk up to a Brazilian platform today and demand to see its 5710. What you can do is establish whether it will ever owe one.
That is the discriminator, and it is the reason this check sits third rather than first. The duty attaches to being inside the authorization process. A platform that never files a request never owes a report, never has a reserve figure examined by anyone, and never appears in a dataset a supervisor can compare against. Its silence is not a gap in the rules but the rules working exactly as written, on a company that stayed outside them.
Then the ceiling, because this check gets oversold. A reserve report records a level on a date. It cannot record what happened between dates, and it cannot record what the operator knows and has not said. Kodex looked at that gap in detail when an exchange's books looked fine while $47M was gone, and the number in that story was not the fraud. The five years of silence around it were.
A filing tells you someone is now obliged to be counted. It does not tell you the count was complete.
These come last on purpose. Not because they matter least, but because an operation with any competence avoids triggering them, so finding none of these proves almost nothing while finding one ends the evaluation immediately.
Guaranteed returns, fixed daily percentages, or any number presented without a loss scenario attached. A deposit instruction that sends a PIX to a personal CPF instead of the company's CNPJ. Any request for your seed phrase or recovery words, for any reason, including "verification" and "migration" and "support needs to restore your wallet". SMS as the only second factor offered. Countdown timers on the deposit page. And the recruitment pattern Brazilian buyers know best: a helpful "manager" who moves the conversation into WhatsApp and keeps it there, where nothing is logged and everything is personal.
Lilith treats the payment instruction as the loudest of them. The account that receives your money is a statement of identity, made by the party receiving it. A company that cannot accept payment as itself has told you what it is before you have finished reading its homepage.
These patterns are how the pipeline actually recruits, and Kodex has mapped how crypto fraud runs in Brazil from first contact to the withdrawal that never processes. Recognising them is fast, cheap and worth doing. It is also the check a professional operation passes effortlessly, which is why it is not allowed to be your first one.
Why this order, and not the fastest one? Because each check costs the other side something different, and the differences are the whole method.
| Check | What it proves | What it cannot prove | What a fake must do to pass it |
|---|---|---|---|
| The entity | A legal person exists, with a name, an address and a start date | That it is solvent, or honest | Register a real company and accept a permanent public record |
| The authorization filing | The platform put a named entity, its owners and its books in front of a supervisor | That the application will succeed | Submit itself to the Banco Central and wait |
| The reserve report | Holdings per asset were declared for a stated date | What happened between the dates | File monthly figures that a later audit can contradict |
| The tells | The operation is careful about the obvious | Anything at all about the balance sheet | Hire someone who has read a list like this one |
Read down the last column and the order explains itself. The cost of passing falls as you go, until the final row costs an afternoon of copywriting. Running the sequence backwards, which is what a red-flag checklist quietly encourages, means the cheapest evidence arrives first and shapes everything you look at afterwards. You form the impression on the free stuff and then go looking for confirmation.
None of this produces certainty, and Lilith would not offer it. A platform can clear all four checks and still fail you, because supervision is not solvency and a filing is not a guarantee. What the sequence buys is proportion: you learn what the other side would have had to spend before you decide what you are willing to send. That is a different question from the one you typed into Google, and it is the one with an answer.
So run them in order and stop at the first failure. The remaining checks are not a second opinion. They are how you talk yourself into it.
Pick the platform where your money is sitting right now and run the four checks against it tonight, in that order, stopping at the first one you cannot answer. Kodex custodies nothing and vets no exchanges: the $5,000 in the simulator is simulated, and crypto, tokenized stocks and metals all trade against it, so you can keep practising the trade while you finish investigating the counterparty.
