Italy’s Guardia di Finanza said on Wednesday 21 October that it had taken apart a “hidden bank” (banca occulta) serving the ‘Ndrangheta, the Camorra and the Foggia crime groups known as the “fourth mafia”, run from a car-rental company in Pero, on the edge of Milan. Thirty people are subject to precautionary measures, 16 in prison and 14 under house arrest, according to ANSA’s report of the operation, published at 07:32 Rome time (05:32 UTC). Investigators say the network issued more than €110 million of false invoices, laundered about €68 million abroad through cryptocurrencies, and they have ordered the urgent seizure of more than €21 million.
Everything below is an allegation. The measures were requested by Milan’s anti-mafia prosecutors (the DDA) and are precautionary orders taken during an investigation, not a verdict; every suspect is presumed innocent until a final conviction. No defence statement had been reported when this piece was written, and the Guardia di Finanza’s own press release could not be found on its website (its press page showed no update after 13 October when we checked), so the account here rests on ANSA, the financial daily Il Sole 24 Ore and other Italian outlets that relayed it.
For crypto readers, the Italy mafia crypto laundering case has one plain gap. No exchange, no stablecoin, no blockchain and no wallet address has been named by the investigators or by any outlet we read. Crypto was, by their account, the last step of a much older machine built on paper invoices and bags of cash.
Three figures, three different things
Headlines in the crypto press put the case at “$76 million”. That number is a conversion of the €68 million laundering figure only, made by the crypto news site Protos. The invoices, the laundering and the seizure are separate amounts, and adding them up would count some of the same money twice.
| Figure | What it measures | Dollar equivalent as reported | Source |
|---|---|---|---|
| More than €110 million | False invoices issued by shell companies | $123 million (Protos) | ANSA, Il Sole 24 Ore |
| About €68 million | International money laundering carried out through cryptocurrencies | $76 million (Protos) | ANSA |
| More than €21 million | Urgent preventive seizure (cash, bank accounts, crypto, cars, boats, jewellery, watches) | $23.5 million (Protos) | ANSA (amount), Virgilio and Crypto Briefing (assets) |
| 30 people | Precautionary measures: 16 in prison, 14 under house arrest | n/a | ANSA |
| More than 350 | Guardia di Finanza officers deployed | n/a | ANSA, Il Sole 24 Ore |
The seizure was still being carried out on Wednesday, smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool diverge, compared with simply holding the same tokens in a wallet. It becomes permanent when the provider withdraws.">Il Sole 24 Ore wrote, so the €21 million is what the order covers, not what has been recovered. Neither ANSA nor Il Sole split it by asset type, which means the crypto share of the seizure is also unknown.
The operation was run by the Guardia di Finanza of Milan and Monza Brianza, through Milan’s economic and financial police unit and the Monza group, on a request from the Milan DDA, in coordination with Italy’s national anti-mafia and anti-terrorism directorate. The force’s central organised-crime unit (SCICO) and its special technology-fraud unit took part. Arrests were also under way in Spain and Switzerland, ANSA reported, and searches took place in several Italian provinces. Il Sole 24 Ore said the foreign side was supported by I-CAN, Interpol’s cooperation project against the ‘Ndrangheta.
How the cash-back machine allegedly worked
The scheme, as investigators describe it, sold a service to businesses that wanted to cut their tax bills and to criminals who needed clean money. A network of shell companies issued invoices for work that was never done. The client company paid those invoices by bank transfer, booked them as costs and lowered its taxable income.
Then the money came back. Couriers returned the same amount to the client in cash, minus a commission that the news site Virgilio put at 2% to 5%. That cash, Il Sole 24 Ore reported, came from tax evasion and drug trafficking. Virgilio and MilanoFinanza added that proceeds of computer fraud and phishing ran through the same circuit. MilanoFinanza also wrote that investigators found transfers coming from people who had reported being cheated while trying to invest in crypto. No outlet gave amounts for either.
So the bank transfers paid for fake invoices sat in the shell companies’ accounts, and the dirty cash ended up in legitimate businesses. What remained was to move the bank money out of reach. According to Virgilio, the remaining funds went to current accounts in Luxembourg, Lithuania and Germany and were then turned into cryptocurrency held in digital wallets linked to the organisation. Il Sole 24 Ore wrote that the bank funds were mostly moved to foreign accounts or used to buy crypto, which investigators describe as hard to trace.
Chinese and Albanian accomplices helped run the circuit, according to Il Sole 24 Ore. Virgilio said Chinese and Calabrian intermediaries collected the cash from drug trafficking and tax evasion.
Who ran the hidden bank, according to investigators
Three Italians managed the Pero company, Il Sole 24 Ore reported. Two are described as long-standing contacts of ‘Ndrangheta clans from Crotone, both already convicted with final judgments in two earlier anti-mafia investigations known as “Infinito” and “Aemilia”. The third is described as a member of the Casalesi clan of the Camorra. We are not naming them: in this case they are suspects, and the charges have not been tested in court.
The car-rental company’s name has not been published in any report we read. Local press quoting the judge’s order described its Pero office as a meeting point for figures from organised crime.
The list of offences, as ANSA gave it, goes well beyond tax: criminal association aggravated by the mafia method and by helping mafia groups, international money laundering, tax fraud, bankruptcy offences, drug trafficking and weapons offences.
The court driver, the lawyer and a former officer
Two of the suspects worked close to the justice system. One is a driver at the Milan office of the judges for preliminary investigations who handled seized assets. He is under house arrest, accused in this investigation of unauthorised access to a computer system, and was already involved in a separate probe, ANSA and Il Sole 24 Ore reported. A Milan lawyer is also implicated; Virgilio wrote that the lawyer is accused of helping the court employee access the systems to keep the group’s leaders informed about the investigation.
One of the force’s own men is also a suspect. Virgilio and the financial daily MilanoFinanza both describe him as a former Guardia di Finanza officer, no longer in service, who allegedly took money from a Chinese suspect in exchange for confidential information and a promise of help with tax collection notices. The Calabrian paper Quotidiano del Sud gives a different version: a serving inspector, now under house arrest for alleged corruption, who is said to have received €3,000 in cash for information on a relative’s tax debts. We could not settle which account matches the judge’s order.
Marcello Viola, Milan’s chief prosecutor, said in a note quoted by Virgilio (we did not find the note itself or the quote in another outlet) that the operation showed his office’s and the Guardia di Finanza’s work against “la penetrazione silente della criminalità organizzata nel tessuto economico e imprenditoriale”, the silent penetration of organised crime into the economic and business fabric. Virgilio said he also pointed to illegal financial tools run through fintech.
Italy mafia crypto laundering: no exchange or coin named yet
The crypto part of the case, as published so far, fits in one sentence: about €68 million was laundered abroad through cryptocurrencies, exchanges and digital wallets. The crypto news site Crypto Briefing, which covered the case on Wednesday, also found no named exchange, stablecoin or blockchain.
These questions have no public answer yet:
- Which exchanges or brokers converted the euros into crypto, and whether they were authorised in the EU under MiCA or based outside it.
- Which coins were bought. No report mentions USDT, USDC or bitcoin by name.
- How much of the €68 million actually went into crypto and how much stayed in bank-to-bank transfers. Crypto Briefing wrote that the €68 million moved abroad “partly” through crypto exchanges and wallets; ANSA does not give a split.
- Whether any of the seized crypto sat on an exchange account that could be frozen, or in wallets the suspects controlled themselves.
The answers matter because they decide where the system failed. If the conversion went through a licensed European platform, the money passed customer checks on the way in; if it went through an offshore broker or an over-the-counter dealer, it did not. Until prosecutors file more detail, both readings are open.
What Italian and EU rules require from crypto providers
Crypto firms in Italy now sit inside the same anti-money-laundering law as banks. The Bank of Italy’s MiCA FAQ says Legislative Decree 204/2024 amended the national AML decree (Legislative Decree 231/2007) to add crypto-asset service providers to the financial intermediaries bound by its duties, and gave the Bank of Italy AML supervisory powers over them. A Bank of Italy measure of 23 July 2025 extended its customer due diligence and internal-control rules to those providers.
The old regime is closing. Firms registered with the OAM, the body that kept Italy’s register of virtual currency operators, could keep working until 30 December 2025, and those that had filed for a MiCA licence by then could carry on until a decision and no later than 30 June 2026, according to a joint notice from Consob and the Bank of Italy of 2 July 2025. Consob’s recent licence for YouHodler shows what an approved provider may do; we covered it in our report on Italy’s MiCA licence for YouHodler, and our MiCA guide explains the regime.
At EU level, the new Anti-Money Laundering Authority (AMLA), based in Frankfurt, says on its website that it expects to start direct supervision during 2028. The next date for the wider package is the EU AML Regulation, listed in our calendar entry on the AML Regulation.
Cross-border seizures are a separate problem. A new Council of Europe protocol on freezing and confiscating criminal assets across borders opened for signature on 14 October, and the EU signed it that day, as we reported in our piece on the Warsaw protocol.
Milan has seen the same model before
The Pero case is the second “hidden bank” taken apart in Milan this year. On 10 July 2026, Teleborsa reported that the Guardia di Finanza had found a network run with Chinese brokers that issued more than €134 million of invoices for non-existent transactions to Italian firms in the ferrous metals trade, sent more than €80 million to foreign accounts and returned cash to clients through couriers, minus a commission. Seven suspects were targeted. That report did not mention crypto.
Crypto has turned up in other Italian mafia cases. In December 2025, Italy and Romania froze more than €40 million in an operation coordinated by Eurojust against a suspect with alleged ties to Sicilian clans, who is accused of laundering money through betting and gaming licences and cryptocurrency, OCCRP reported.
What is new in Pero is the scale of the crypto leg, €68 million, and the presence of a court employee who handled seized assets.
What happens next
The suspects can contest the measures before Italian courts, and none has been convicted. Those detained are first questioned by the investigating judge, usually within days of the arrest; no hearing dates or defence statements had been published by the evening of 21 October. The Spanish and Swiss arrests still have to go through extradition or surrender procedures before those suspects reach Milan. For crypto readers, the detail to watch is whether prosecutors name the platforms that turned the euros into crypto, which would show whether a licensed European exchange let the money through.