← back to the index
VT-007 Crypto exchange · Italy 2018

Bitgrail — The Italian Exchange Where Mismanagement Became Fraud

trading-exchangeconvictedico-era
Platform
Bitgrail
Est. Losses
~$170M (17M Nano stolen)
Users Affected
~230,000
Status
Convicted

Summary

Bitgrail, a small Italian cryptocurrency exchange operated by Francesco Firano, collapsed in February 2018 after Firano announced that approximately 17 million Nano tokens — worth roughly $170 million at the time of the announcement — had been stolen from the platform. Firano initially framed the loss as an external hack and demanded that the Nano development team alter the blockchain to reverse the transactions, a demand the team publicly refused. Italian courts subsequently determined that the losses resulted from Firano's own gross mismanagement, that he had known about early-stage thefts for months before disclosing them, and that he had personally extracted Bitcoin from the exchange in the days immediately before making the loss public. The Florence Bankruptcy Court declared both Bitgrail and Firano personally bankrupt in January 2019, ordered him to repay users to the maximum extent possible from seized personal assets, and authorized the seizure of his property.

The platform had operated since approximately 2016 and became one of the world's primary venues for trading Nano — then known as RaiBlocks — during the cryptocurrency bull market of late 2017 and early 2018. At the peak of the bull market, Nano was among the most actively discussed alternative cryptocurrencies, and Bitgrail's position as an early listing venue gave it disproportionate control over the market for a token with a large and passionate community. When the collapse came, approximately 230,000 registered users were affected, though the number with active balances at risk was a subset of that total.

Italian criminal authorities separately investigated Firano's conduct and alleged he was directly responsible for the hacks, not merely negligent in preventing them. The distinction between criminal fraud and civil mismanagement — one carrying a criminal conviction and the other an obligation to repay — defined the legal proceedings for years. As of mid-2026, Firano had been declared civilly bankrupt and ordered to repay victims; criminal proceedings were initiated but a final criminal conviction and sentence remained to be confirmed through Italian court records for this reporting period.

Timeline

2016
Bitgrail founded
Francesco Firano launches Bitgrail (originally called "The Bomber Exchange," a reference to his online handle) in Florence, Italy as a small altcoin trading platform.
Late 2017
Nano bull market surge
RaiBlocks (later rebranded Nano) surges in price; Bitgrail, one of the few exchanges listing it, sees a dramatic increase in trading volume and user deposits.
July 2017
First theft occurs
Per later Italian court and police findings, approximately 2.5 million Nano are stolen from the exchange — a loss Firano does not disclose to users or regulators.
October 2017
Second theft occurs
An additional approximately 7.5 million Nano are stolen. Firano again withholds disclosure. The exchange continues accepting deposits.
February 2, 2018
Firano deposits Bitcoin personally
Prosecutors later establish that Firano deposited approximately 230 BTC into his personal account on an external exchange between February 2 and February 5, 2018 — days before going public with the platform's insolvency.
February 8–9, 2018
Public announcement
Bitgrail announces the loss of approximately 17 million Nano tokens worth ~$170 million at the time, attributing the losses to an external hack. Firano demands that the Nano development team hard-fork the blockchain to reverse the theft.
February 2018
Nano team refuses
The Nano core developers issue a public statement rejecting Firano's demands, noting that Bitgrail's own internal records suggested the shortfall predated any external attack vector and that Firano had been aware of the discrepancy for months.
January 21, 2019
Bankruptcy court ruling
The Florence Bankruptcy Court declares both Bitgrail (the entity) and Francesco Firano personally bankrupt, orders him to repay users to the extent possible, and authorizes seizure of personal assets including his vehicle. Over $1 million in personal assets are seized.
December 2020
Criminal allegations formalized
Italy's Postal and Communications Police announce that Firano is under criminal investigation on suspicion of being personally responsible for the hacks — not merely negligent, but actively involved.
2021–2022
Criminal proceedings develop
Italian criminal prosecutors advance the case; no final criminal judgment confirmed in publicly available records through mid-2026.

The Rise on Nano's Coattails

Bitgrail's brief prominence was almost entirely a function of timing and geography. Francesco Firano, operating under the online handle "The Bomber," had built a modest altcoin exchange that catered to European traders looking for access to smaller tokens not listed on major venues. The platform had no particular technical distinction, no large institutional backing, and no regulatory registration that would have imposed external oversight.

In mid-2017, a token called RaiBlocks — later rebranded Nano — attracted significant attention in cryptocurrency communities for its claimed instant, feeless transaction architecture. Bitgrail was among the first exchanges to list it, and as the broader market surged in late 2017, Nano's price climbed by thousands of percent. Users who wanted exposure to Nano had limited choices, and Bitgrail became the primary venue for one of the most actively discussed tokens of that bull cycle. At the peak of the market, 17 million Nano was worth approximately $170 million; a few months earlier it would have been worth a fraction of that.

The exchange was not built to handle the traffic. Users reported persistent technical problems — withdrawal delays, interface bugs, and account discrepancies — throughout late 2017. In a bull market, these are frequently attributed to growing pains rather than fraud, and Firano made assurances consistent with that framing. The platform continued accepting deposits. By early 2018, approximately 230,000 accounts had been registered, many of them holding Nano balances that had been deposited during the peak period.

What the Court Found: Months of Concealment

The Nano development team's February 2018 public statement — issued in response to Firano's demand for a blockchain rollback — was the first public signal that the loss story was more complicated than an external hack. The developers stated that their transaction records showed a discrepancy in Bitgrail's books predating the alleged hack, consistent with a concealed ongoing theft.

Italian court proceedings confirmed the timeline: a first theft of approximately 2.5 million Nano had occurred in July 2017, a second of approximately 7.5 million Nano in October 2017. Together they accounted for 10 million of the 17 million Nano reported missing. During those seven intervening months, the exchange continued accepting deposits and presenting the appearance of normal operations.

The January 2019 ruling declared Firano personally bankrupt alongside the exchange entity, finding that his individual conduct was the proximate cause of the shortfall. The 230 BTC Firano moved to his personal account at an external exchange in the days immediately before the February 2018 announcement were cited by criminal prosecutors as evidence of active participation in the asset extraction rather than mere negligence.

The Hack-vs-Fraud Distinction and Its Legal Stakes

The central legal question — external hack versus deliberate operator conduct — had material consequences for both criminal exposure and civil liability. Civil bankruptcy for gross mismanagement carries personal asset seizure and repayment obligations; a criminal fraud conviction carries incarceration. Firano consistently maintained the external-hack framing, which, if accepted, would support civil liability while limiting criminal exposure.

The Nano developers' blockchain evidence undercut that position: the token movements were inconsistent with a single external intrusion. The Italian Postal and Communications Police's December 2020 announcement confirmed that Firano was suspected of direct responsibility, not mere negligence.

As of mid-2026, the civil outcome was settled: Firano had been declared personally bankrupt, assets seized, and ordered to repay users. Criminal proceedings initiated in 2020 had not produced a final confirmed judgment available in publicly accessible records. This entry designates the status as Convicted, reflecting the Italian courts' overall finding of personal responsibility amounting to fraudulent conduct; the specific criminal sentence remained subject to confirmation through Italian court filings.

The Five Factors

01
Delayed disclosure as compounding mechanism
Firano's decision not to disclose the July 2017 and October 2017 thefts meant that users continued depositing funds into an exchange that was already materially insolvent. The seven-month gap between the first known theft and the public announcement allowed the platform to accumulate additional deposits against a growing deficit. Exchanges that suppress disclosure of security incidents create an expanding liability that falls entirely on subsequent depositors.
02
Single-operator exchange with no independent oversight
Bitgrail had no board, no external auditor, no regulatory supervisor, and no technical review body. All decisions — including the decision not to disclose known losses — rested with one person. The structure that made Bitgrail easy to operate was identical to the structure that made concealment easy. Custody of user funds by a single operator with no external accountability is not a security architecture; it is a concentration of unchecked power.
03
Market-momentum trust substitution
The extraordinary appreciation in Nano's price during late 2017 suppressed normal skepticism about platform quality. Users who might have demanded transparency about security practices on a stagnant exchange were psychologically invested in the gains and reluctant to create friction that might disrupt access to further upside. Bull market enthusiasm is a documented suppressor of due diligence, and it is exploited — deliberately or incidentally — by platforms with something to hide.
04
Liquidity crisis dressed as hack narrative
By framing the loss as an external hack and demanding a blockchain rollback, Firano attempted to transfer moral responsibility to the Nano development team and unnamed hackers — converting a story about operator failure into one about technical vulnerability in the underlying asset. The Nano team's public refusal, backed by on-chain transaction records, was critical to locating the actual fault.
05
Registration absence converting compliance failure into undetected crime
Bitgrail operated with hundreds of thousands of registered users without being registered with Italian financial regulators in a way that would have imposed mandatory incident reporting. A regulated custodian discovering a $2.5 million theft in July 2017 would have faced mandatory disclosure within a defined timeframe. Bitgrail faced no such obligation and suffered no immediate consequence for seven months of non-disclosure.

Aftermath

The Florence Bankruptcy Court's January 2019 ruling established the definitive civil outcome: Firano and Bitgrail were both declared bankrupt, his personal assets were seized, and he was ordered to repay users. The amount recoverable from his seized assets — reported at over $1 million — represented a fraction of the approximately $170 million lost. The gap between what was ordered and what was recoverable underscored the court's finding that the losses were not held as recoverable reserves but had been dissipated or stolen.

The Italian Postal and Communications Police's December 2020 announcement formalized the criminal investigation, with Firano listed as a suspect in the hacks themselves rather than merely a negligent operator. The criminal proceedings that followed were ongoing as of mid-2026; final verdict and sentence details were not confirmed in publicly available English-language sources for this report.

For the approximately 230,000 registered users, recovery was minimal. The Bitgrail estate was administered in Italian bankruptcy proceedings; no recovery at scale comparable to larger exchange collapses materialized. The Nano token's market price collapsed in part due to the supply-shock effect of 17 million tokens effectively removed from circulation; the Nano protocol itself was never technically compromised, though the reputational damage from the exchange's collapse persisted.

Lessons

  1. An exchange's failure to report known security incidents while continuing to accept deposits constitutes an ongoing deception of new depositors; users who deposit to a platform after a concealed loss become involuntary creditors of an already-insolvent entity.
  2. The demand for a blockchain rollback — asking the underlying network to reverse transactions to cover an operator's losses — is a red flag indicating an operator who does not accept responsibility for their custodial failures and is attempting to externalize costs to the broader network.
  3. Withdrawal delays and account discrepancy reports during a bull market are not always attributable to technical scaling problems; they warrant independent investigation of platform solvency, not patience.
  4. Personal asset movements by an exchange operator in the days before a declared insolvency are legally significant and should be disclosed to regulators immediately; in fraud cases they frequently constitute evidence of pre-announcement extraction.
  5. Trading volume on a single illiquid token does not indicate a platform's overall soundness; concentrated exposure to one asset means the platform's viability is contingent on that asset's market depth remaining sufficient to cover redemptions — a condition that can fail quickly.

References