The group rented 1071 Rua 25 de Março and presented it as P.S. de Souza Grama Sintética. The functioning storefront explained deliveries, soil and continuous activity while shielding preparations.
Working in shifts, the crew excavated a narrow passage more than 75 metres long beneath central Fortaleza. Timber reinforcement, lighting, ventilation and cooling allowed sustained underground work.
Three days before the burglary, witnesses identified men linked to the later proceeds network attempting to rent an aircraft. The federal appellate record treated this as evidence of advance planning for rapid movement after the theft, although the attempted charter was not itself proof that cash ultimately travelled on that plane.
From Friday night into Saturday morning, the burglars completed the breach through the vault floor and moved approximately 3.5 tonnes of circulated R$50 notes back through the tunnel. The exact minute-by-minute operation was not established publicly, so the sequence distinguishes documented physical findings and court evidence from later reconstruction.
Prosecutors said part of the money was sent to São Paulo as commercial-airline baggage while participants also left by air and road. Airport images and later financial transactions helped investigators reconstruct the movement.
Employees reopening the branch on Monday found the vault breached. Investigators traced the tunnel back beneath the street to the front property and began a multi-state inquiry.
Investigators linked a bulk cash purchase of eleven vehicles to José Charles Machado de Morais. Police intercepted the transporter and found R$6 million concealed in three cars.
Federal Police arrested five men at a Fortaleza property, recovered about R$12.25 million and obtained admissions concerning the tunnel work. The operation also sharpened the focus on the alleged organisers.
Men posing as police abducted Ribeiro in São Paulo. Although a ransom was reportedly paid, his body was found the next day near Camanducaia and identified later that month.
A federal judge imposed 49-year, two-month sentences for qualified theft and connected offenses. Appellate proceedings later reduced both terms to 35 years and ten months.
After more than three years, the investigation had expanded far beyond the tunnel crew to a large money-laundering network. Later summaries report 129 indictments and hundreds of witnesses, while much of the cash remained unrecovered.
Agents arrested the alleged tunnel specialist in Vila Mariana after more than a year of surveillance, closing one of the investigation's most prominent outstanding manhunts.