The suspect is accused of offering €10,000 (£8,700; $12,000) in Bitcoin in return for the attack, which would have paralysed the woman, police said.
He was traced by Italian authorities and the EU's crime agency and the woman was unharmed.
The would-be attacker has not been identified.
"It looks like the plot of a contemporary thriller," Italy's Postal and Communication Police said in a statement.
The suspect, a 40-year-old IT expert from the northern region of Lombardy, is alleged to have gone on the dark web some months after his relationship broke down in July 2020.
Police said he contacted an intermediary via a website on the dark web, seeking to hire an attacker to throw acid at his ex-girlfriend's face and to break her back, leaving her paralysed.
Despite having made the first of four payments to the would-be attacker, the suspect remained in contact with his intended victim, sending her flowers and messages, according to police.
Italian news agency Adnkronos quoted the arrest warrant as saying that the attack was to be staged to look like a robbery.
The suspect, who had been in a two-year relationship with the woman, had passed on her home address and Facebook profile, the news agency added.
Italian authorities said they were alerted after messages from the suspect were intercepted by police from another European country in February.
The request had been placed through the Tor network - privacy-focused software used to access the dark web while often obscuring users and data.
However, EU crime agency Europol said it was able to carry out "an urgent, complex crypto-analysis to enable the tracing and identification" of the Bitcoin provider, based in Italy.
Italian police were then able to get hold of further details about the suspect from the crypto-currency provider.
The suspect's home in Milan was searched at the end of February, according to Italian media, and as the search unfolded he is then said to have called off the attack via his computer.
He is currently under house arrest, charged with aggravated harassment and attempted personal injury, reports say.