TL;DR:
- The Cryptocurrency Section of the Italian Carabinieri recently arrested Franco Lee, a Chinese national operating an illicit cryptocurrency exchange service, and seized a portion of the digital assets. The operation dismantled a network that had laundered approximately €8.8 million between 2021 and 2024.
- This success was powered by advanced investigative techniques, combining the Carabinieri’s proprietary scripts with Chainalysis Reactor for network analysis and Wallet Scan for rapid wallet identification from fragmented seed phrases.
- The investigation highlights the growing technical sophistication of European law enforcement and sets a clear precedent for tackling complex crypto-related financial crimes.
In a testament to the increasing power of blockchain forensics, the Italian Carabinieri recently dismantled a sophisticated, multi-million euro illicit cryptocurrency exchange service. The operation, which led to the arrest of Chinese national Franco Lee, showcases how advanced analytical tools and investigative work can overcome complex obfuscation techniques, including the deliberate fragmentation of seed phrases.
This case highlights Italy’s proactive stance in combating crypto-enabled crime and underscores the critical role of public-private partnerships in securing the digital asset ecosystem.
An international network run from Italy
Between 2021 and 2024, Franco Lee operated an illicit financial service, primarily based in Rome and Frascati, Italy. Lee promoted unauthorized financial investments, and engaged in money laundering and self-laundering, facilitating approximately €8.8 million in crypto transactions. By charging transaction fees of 5% to 10%, he offered clients a way to bypass financial compliance regulations and achieve anonymity.
Although based in Italy, Lee’s network had significant international touchpoints. He utilized foreign crypto exchanges and conducted transactions in France, Switzerland, and Spain. His connections to international crypto communities were further demonstrated by his public appearance at the “Blockchain Week” event in Rome.
Cracking the code: From fragmented phrases to concrete evidence
The subsequent investigation presented unique and complex challenges. Lee leveraged the inherent characteristics of cryptocurrency — pseudonymity, cross-border transfers, and decentralization — to attract clients and evade scrutiny. He intentionally complicated the recovery process by fragmenting more than 50 seed phrases across numerous pieces of paper found in a safe deposit box.
This is where the Carabinieri’s Cryptocurrency Section’s expertise came in. They were able to combine multiple advanced techniques:
- Network analysis with Chainalysis Reactor: Reactor provided the critical blockchain analysis tools needed to map Lee’s network. Investigators used the software to establish clear patterns, identify the illicit flow of funds across multiple blockchains and exchanges, and comprehensively map transactional paths.
- Reconstructing seed phrases: Faced with the fragmented seed phrases, investigators employed specialized brute force techniques and proprietary scripts developed specifically by the Carabinieri. This painstaking work allowed them to reconstruct the complete phrases.
- Accelerating seizures with Wallet Scan: After reconstructing the seed phrases, the Carabinieri used Wallet Scan to analyze the phrases. Wallet Scan helped speed up the investigative process and allowed for the precise identification of the wallets containing the illicit funds.
The Carabinieri was able to successfully seize a portion of the cryptocurrency, including bitcoin, ether, USDT, and Matic.
A new precedent for crypto investigations
The Carabinieri’s operation underscores the evolving capability of law enforcement to combat sophisticated financial crimes. Despite the pseudonymous nature of crypto, the application of advanced blockchain forensic tools can effectively de-anonymize transactions and dismantle criminal networks.
As stated by Major Simone Vecchiarello, Head of the Cryptocurrency Section of the Carabinieri Currency Anti-Counterfeiting Unit, “Through meticulous blockchain analysis using Chainalysis Reactor, we have clearly demonstrated our capability to identify, disrupt, and dismantle complex illicit financial networks. This operation sets a clear precedent for future investigations and highlights the necessity and effectiveness of specialized tools in combating cryptocurrency-enabled crimes.”
This website contains links to third-party sites that are not under the control of Chainalysis, Inc. or its affiliates (collectively “Chainalysis”). Access to such information does not imply association with, endorsement of, approval of, or recommendation by Chainalysis of the site or its operators, and Chainalysis is not responsible for the products, services, or other content hosted therein.
This material is for informational purposes only, and is not intended to provide legal, tax, financial, or investment advice. Recipients should consult their own advisors before making these types of decisions. Chainalysis has no responsibility or liability for any decision made or any other acts or omissions in connection with Recipient’s use of this material.
Chainalysis does not guarantee or warrant the accuracy, completeness, timeliness, suitability or validity of the information in this report and will not be responsible for any claim attributable to errors, omissions, or other inaccuracies of any part of such material.