Lorenzo Franceschi-Bicchierai

Lorenzo Franceschi-Bicchierai is a cybersecurity reporter and editor who focuses on the human and political fallout of hacking, surveillance, and digital espionage. His work at TechCrunch and in freelance roles follows how hackers, governments, and companies collide, often at the intersection of online platforms, financial systems, and human rights. Within the crypto space, he distinguishes himself by treating breaches and abuses as stories about victims, power, and infrastructure rather than markets alone.

Crypto platforms under attack

When he covers crypto, Franceschi-Bicchierai does it through a security lens, using incidents on trading and prediction platforms as case studies in how technical failures translate into real losses for users.

In his report on hackers stealing funds from Polymarket users, he traces the breach to a compromise at a third-party vendor that allowed malicious code to be injected into the site, focusing on the mechanics of the intrusion rather than price movements. He details how Polymarket first disclosed the issue publicly, then moved to contain it, identify affected users, and commit to refunding them in full, keeping the emphasis on remediation and accountability.

The piece pulls in outside visibility from blockchain monitoring firm PeckShield, which estimated around $3 million in stolen cryptocurrency, as well as a blockchain analyst and social media posts from victims, showing his habit of triangulating company statements with independent technical analysis and user testimony. Classified under security coverage at TechCrunch, the story is written as a concise incident brief, but still walks through attack vector, impact, and response in a way that a non-specialist reader can follow.

This combination of quick-turn alerts and precise technical context is the thread that runs through his crypto-related work.

Government spyware and surveillance infrastructure

Franceschi-Bicchierai’s core beat extends beyond individual hacks into the ecosystem of government spyware and surveillance technology. In his feature on the team that hunts government spyware, he profiles a digital security helpline that supports journalists and activists targeted with high-end intrusion tools, making clear the link between abstract malware campaigns and people’s safety. The piece explains how this team investigates suspected infections and responds to victims, treating the helpline as part of a broader human-rights infrastructure rather than a purely technical service.

His longer-term work includes a book in progress about the surveillance tech startup Hacking Team and the history of government spyware, which anchors his reporting in a deep understanding of how these tools are built, sold, and deployed.

On his professional site he describes his focus as chronicling the contemporary cyber era and the intersection of hackers, human rights, and intelligence services, and that perspective informs how he frames stories about state-linked operations. Examples such as his coverage of a mysterious hacking group known as Careto, described as being run by the Spanish government, show him following the trail from malware campaigns back to state actors and their motives.

This recurring attention to government-grade tooling, export-controlled software, and the people targeted by it marks his surveillance coverage as more investigative and structurally minded than routine breach reporting.

Profiles and investigations into the people behind security

Alongside incident write-ups, Franceschi-Bicchierai invests heavily in profiles and investigations that surface the individuals shaping modern security and insecurity.

His profile of Window Snyder presents her as a trailblazer who helped secure the internet and billions of devices, using her career to show how design choices and early security work still shape today’s threat landscape. In another long-form investigation, he tells the story of a U.S. defense contractor who leaked hacking tools to Russia, treating it as both an espionage case and a cautionary tale about insider risk in highly sensitive cyber operations. He has also reported on covert hacking groups and their government ties, such as the Careto operation, again focusing on the people and institutions behind the malware rather than only the code itself.

Across these pieces, he works in multiple formats - blogs, short news articles, investigations, and long-form features - and uses each to connect technical detail to political context and personal consequence.

His body of work at TechCrunch from 2023 to 2026 sits within that arc, positioned as senior-level coverage of hacking, cybersecurity, surveillance, and privacy, and builds on more than 15 years of experience reporting on these themes across different outlets. Taken together, his reporting is distinguished by its combination of incident-level specificity, structural analysis of surveillance and spyware, and narrative attention to the practitioners, whistleblowers, and targets who inhabit the security world.