FF
Attribution profile
- Type
- Insider - Disgruntled
- Location
- Italy
- Known incidents
- 1 incident
- Sources
- 0 sources
- First seen
- 2018-01-01
- Last seen
- 2018-01-01
- Updated
- 2026-10-04 00:05
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
FF, also known by the alias FF, is an individual associated with Italy who served as a former administrator of the BitGrail cryptocurrency exchange. The actor’s activities were confined to the cryptocurrency sector, specifically targeting the BitGrail platform and exploiting a vulnerability in the NANO protocol to conduct unauthorized transactions that resulted in approximately €120 million in losses. The strategic objective was financial gain, involving IT fraud, fraudulent bankruptcy, and self‑laundering, with the administrator allegedly aware of the bug but failing to remediate it while collaborating with unidentified hackers. No malware families, specific initial access vectors, or tooling styles are described in the source material. Public attribution points to an individual actor without any indicated state nexus or criminal consortium affiliation. The BitGrail incident represents the sole publicly reported operation linked to FF.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 0 sources.