Italy decides to extradite Chinese man wanted by US for hacking

Italy has confirmed the extradition of Xu Zewei, a 33-year-old Chinese national accused by U.S. authorities of participating in cyber-espionage operations targeting American research institutions during the early stages of the COVID-19 pandemic according to Italian court records. Xu was arrested in Milan, Italy, on July 3, 2025, at the request of the U.S. Department of Justice, and has since been held in a Milanese prison pending extradition proceedings as reported by CNN.

According to the U.S. indictment, Xu worked under the direction of China’s Ministry of State Security (MSS) and targeted U.S.-based universities, virologists, and immunologists conducting research on vaccines, treatments, and testing for the virus as detailed in the Justice Department's announcement. The indictment also alleges that Xu and his co-defendant, Zhang Yu, exploited vulnerabilities in Microsoft Exchange Server software as part of a broader cyber campaign known as HAFNIUM, which compromised thousands of systems globally according to the indictment.

The U.S. Justice Department has emphasized the significance of the arrest, calling it a demonstration of the United States' commitment to holding accountable those who engage in cyber intrusions against American institutions as stated in a Justice Department press release. The FBI has noted that Xu is among the first hackers linked to Chinese intelligence services to be captured by U.S. law enforcement according to FBI reports.

Italy's highest court recently confirmed the extradition, leaving the final decision in the hands of Justice Minister Carlo Nordio, who has 45 days to approve the transfer as reported by Italian media. The extradition process has drawn attention due to the diplomatic sensitivities involved, as Italy seeks to balance its relationship with the United States and its economic ties with China according to diplomatic analysis.

Xu's defense has raised procedural concerns, including the absence of Chinese translations of case documents and questions about the legal threshold for extradition as noted by legal experts. Meanwhile, the Chinese Embassy in Washington has stated that it is unaware of the case but has reiterated China's position that its vaccine research is among the most advanced in the world and that there is no need for such activities according to embassy statements.

The extradition of Xu could set a precedent for future cases involving state-sponsored cyber activities and may influence broader U.S.-China tensions related to cybersecurity and intellectual property. As the case moves forward, it highlights the growing importance of international cooperation in addressing cyber threats and enforcing legal accountability across borders.