Cyber Incident Victim: BitGrail
Date:
Jan 2018
Location:
Italy
Summary
A former administrator of the BitGrail cryptocurrency exchange faced legal restrictions prohibiting business activities and executive roles following allegations of a €120 million IT fraud, fraudulent bankruptcy, and self-laundering. The fraud stemmed from the exploitation of a bug in the NANO cryptocurrency protocol, enabling unauthorized transactions that resulted in substantial losses. Investigations revealed the administrator allegedly knew of the vulnerability but failed to address it, profiting from the situation and collaborating with unidentified hackers who remain at large.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In February 2018, the Florence Compartment initiated an investigation into BitGrail, a cryptocurrency exchange platform, following a complaint filed by its former managing director, referred to as FF. FF reported the theft of approximately €120 million worth of Nano cryptocurrency (formerly RaiBlocks – XRP) from the exchange. The theft occurred in January 2018 when attackers exploited a bug in the Nano protocol, enabling unauthorized transactions. Italian law enforcement, including financiers attached to the Florentine Public Prosecutor’s Office, collaborated on the case. Investigators determined that FF, a 34-year-old Italian national, had failed to address the protocol vulnerability despite awareness of its existence. The judge overseeing the preliminary investigation, Dr. Gianluca Mancuso, alleged that FF’s inaction facilitated the theft and that he subsequently profited from the incident. FF faced accusations of IT fraud, fraudulent bankruptcy, and self-laundering related to the loss of funds.
On December 24, 2020, the court imposed a precautionary measure prohibiting FF from conducting business activities or holding executive roles in companies. The ruling emphasized FF’s alleged collaboration with the unidentified hackers by intentionally neglecting to patch the bug. No arrests of the hackers responsible for the theft had been made as of the article’s publication. The financial impact of the incident amounted to the loss of 120 million euros in Nano cryptocurrency, affecting BitGrail’s users and operations. The case remained under judicial review, with FF subject to ongoing legal restrictions while authorities continued efforts to identify the perpetrators.