Written by: Sam Schechner, Robert McMillan, Angus Berwick
Translated by: Luffy, Foresight News
A wrench lying on overflowing code, symbolizing crypto crime
Early Tuesday morning, shouts of "Help! Help! Help!" echoed through the narrow streets of a fashionable district in Paris.
Three masked men suddenly pounced on a 34-year-old woman whose father is the head of the French cryptocurrency exchange Paymium. The masked individuals brandished pepper spray canisters and an item resembling a gun, attempting to forcibly push the woman and her young child into a white van disguised as a delivery truck.
However, the woman's husband immediately stood between his family and the attackers, and a neighbor quickly scooped up the child. The woman shouted, "Let me go!" The attackers struck her husband with batons, leaving his head bloodied as captured by nearby building surveillance cameras.
Subsequently, other neighbors gathered around, with a shop owner preparing to throw a fire extinguisher. The failed kidnappers jumped into the van's back seat and fled in panic.
This brazen attack is the latest in a global wave of violent kidnappings targeting cryptocurrency executives and their families. Victims have been beaten with gun butts, kidnapped, and in two cases, even had fingers cut off.
The criminals' target is clear: millions of dollars in cryptocurrency ransom.
These attacks are typically called "wrench attacks" because criminals rely on simple tools to inflict pain and coerce victims, rather than using sophisticated hacking techniques to steal.
From Digital Defense to Real-World Threats
For a long time, hacking has been the primary risk faced by crypto millionaires. But to defend against hackers, savvy investors increasingly store cryptocurrencies in offline physical devices, making remote theft more difficult. However, real-world crypto crime bypasses these security measures.
"Many have reached a safety level of hiding gold under the mattress," said Jameson Lopp, co-founder of Bitcoin security company Casa, "but if you're a high-profile person... you must be wary of physical attacks."
This week, cryptocurrency exchange Coinbase disclosed that personal information for up to 97,000 customers (including addresses and account balance snapshots) was leaked, further escalating these concerns. The company stated that the data might have been stolen by bribed customer service contractors or employees and rejected a $20 million ransom demand.
Another factor stimulating crime is the surge in cryptocurrency value, with Bitcoin rising 54% in the past year, creating a large pool of potential high-net-worth targets.
According to government officials and industry experts, at least five cryptocurrency-related kidnapping cases have occurred in France in recent months, with dozens of similar cases recorded globally in the past year. Local media reported that in July last year, an Australian crypto billionaire narrowly escaped a kidnapping in Estonia, fending off attackers disguised as painters. In March, a crypto influencer in Houston was attacked at home, with her husband engaging in a gunfight with late-night intruders demanding her laptop.
Some attacks were clumsy, with criminals quickly apprehended, but there are indications that organized crime groups see significant profit potential.
"Criminals are probing to see what the return on investment is for 'wrench attacks,'" Lopp said.
Last September, a Florida man was sentenced to 47 years in prison for leading a cross-state home robbery gang targeting cryptocurrency holders. In one attack, he held a pink revolver to a 76-year-old man's head in Durham, North Carolina, threatening to cut off his genitals. The victim ultimately transferred 150,000 dollars in cryptocurrency, and the man was later ordered to pay over $500,000 in compensation.
Friday morning, French Interior Minister Bruno Retailleau summoned cryptocurrency company executives to discuss new security measures for the industry. Retailleau stated that Tuesday's attack was similar to recent kidnappings in France, with officials noting that the masterminds recruit unseen young criminals through apps like Telegram and Signal, then "remotely control" the planned actions.
"These cases are likely connected," Retailleau said in a television interview.
The Cost of Online Wealth Flaunting
So far, reported "wrench attack" victims are mostly associated with industry personalities, either known for working in cryptocurrency or attracting attention by flaunting wealth online.
Killian Desnos, an online gambling influencer known by the username Teufeurs, was famous for YouTube and Twitch livestreams. Prosecutors said that in August 2023, someone disguised as an Amazon delivery person rang the doorbell of his father's home in a small town in northwestern France.
This person and an accomplice forcibly dragged Desnos's father into a car and quickly sent Desnos a ransom video: his father bound, with a gun to his head. Prosecutors said Desnos was living in Malta at the time, reporting to the police while also paying the ransom. The next day, his father was rescued, and police quickly arrested two suspects.
"Now I realize that showing off wealth online is not a good thing," Desnos wrote on X platform at the time.
A key question now is how criminals identify targets in the real world and how to respond.
Cryptocurrency community members have set Instagram profiles to private and tried to remove their and their families' addresses from public records. One executive said he was particularly concerned about young children. After the Tuesday attack, Paymium called for authorities to reduce information disclosure obligations, stating that data leaks could put customers at risk.
Besides the Coinbase data breach, two other leaks have worried investigators: first, the 2020 July hack of French cryptocurrency wallet company Ledger, which produces physical devices for offline cryptocurrency key storage. Hackers infiltrated Ledger's database, ultimately leaking 272,000 customers' names, emails, and mailing addresses online. The second was the breach of risk advisory firm Kroll, where hackers obtained addresses and other personal information of creditors in the Genesis bankruptcy proceedings.
Cybersecurity investigators say the data from these two hacks has circulated on criminal forums.
Others point out that massive personal data has been stolen and leaked over the past decade. In France, public company registration records might include entrepreneurs' home addresses.
MetaMask wallet company security researcher Taylor Monahan said cybercriminals excel at targeting victim addresses by cross-referencing databases or even purchasing information. This information is often publicly used to threaten and expose victim identities, a cyber attack known as "doxxing".
"The younger generation is very internet-savvy and excellent at doxxing," she said.
Some Ledger users have already complained that the data leak has exposed them to extortion and threats. In early 2021, Los Angeles cinematographer Naeem Seirafi began receiving phishing emails and texts demanding he enter Ledger account information to verify new deposits or prevent asset loss due to a "vulnerability".
Later, someone sent him messages demanding 0.3 Bitcoin (worth about $10,000 at the time) as ransom, threatening to attack his family otherwise. "You hold a large amount of cryptocurrency," the message said, "I will share this information with bad people in your area."
The threat became real: When Seirafi was out, his parents encountered a "virtual alert" at home. Local police received a 911 call claiming someone had shot a friend at Seirafi's residence. According to police reports, nearly ten officers raided his home and confirmed it was a prank after investigation.
Seirafi later joined the class-action lawsuit against Ledger in the California local court, seeking compensation. The lawsuit stated: "For hackers, Ledger's customer list is a gold mine."
The lawyer representing the class-action lawsuit declined to comment. Ledger argued in court that Seirafi had not suffered losses due to the data breach because he did not lose any funds. The company's spokesperson refused to comment further.
"Finger: 9/10"
David Balland, one of Ledger's co-founders who is no longer directly involved in the company's affairs, was kidnapped at gunpoint with his partner near Vierzon in central France, according to French officials.
In January 2023, French police blocked the scene on Mereau Street near Vierzon, France, after the kidnapping
Hours later, other Ledger co-founders (including Eric Larchevêque) received ransom messages from the mastermind, demanding a 10 million euro payment. According to informed sources, they confirmed the information was genuine based on David's T-shirt, with one message containing a video of the attackers cutting off Balland's finger.
Police negotiators, together with Larchevêque, communicated with the kidnappers, trying to delay time, approving an initial payment of over 1 million euros while investigators searched for Balland and his partner's location.
"This was a race against time," Paris prosecutor Laure Beccuau later said in a TV interview, "We wanted to rescue the two hostages and save their lives."
The police eventually tracked down the kidnappers to a rented house near a farmland, about 40 minutes south of the kidnapping site. The police raided the house and rescued Balland, but his partner was not there.
"We thought they would be held together, and when we discovered they were separated, the situation became very tricky," said Nicolas Bacca, another Ledger co-founder.
It wasn't until the next day that Balland's partner was found in a stolen van, located one and a half hours north, by which time another ransom had been paid.
Paris prosecutor Laure Beccuau held a press conference after Balland and his partner were kidnapped
Fortunately, the mastermind requested payment in USDT, a cryptocurrency pegged to the US dollar that can be frozen. The Ledger team immediately initiated a freezing plan after the hostages were released, and according to informed sources, they successfully recovered about 80% of the 3 million euro ransom paid, and recovered more in the following days.
"We experienced unimaginable violence," Balland wrote on social media, requesting privacy for his family. According to screenshots at the time, he temporarily changed his X platform profile description to: "Finger: 9/10".
It is currently unclear how the attackers found Balland's address. Informed sources said his home address was not exposed in the Ledger data breach.
In April this year, the prosecutor brought preliminary charges against a man. Informed sources said this person was already imprisoned for kidnapping Desnos's father in 2023 and allegedly assisted in planning Balland's kidnapping while in prison. Investigators are still investigating whether he was employed by other masterminds.
Earlier this month, another Maltese cryptocurrency entrepreneur's father was kidnapped while walking his dog in Paris, with a ransom video showing the old man having a finger cut off. According to the prosecutor, several people were arrested in this attack, all between 18 and 26 years old.
In less than half a month, another typical case occurred.
On Tuesday, the daughter of Paymium's CEO, with her husband's assistance, fought back and successfully escaped. Police said the "gun" at the scene was a toy.
Eric Larchevêque, Ledger co-founder, in 2018
Source: Bloomberg
"They are currently in good condition," Paymium CEO Pierre Noizat said in a TV interview last Friday, referring to his daughter and son-in-law, calling his son-in-law a "hero" who "got a few stitches".
Noizat and other attack victims stated that this crime wave is undermining their confidence in France's ability to control criminal gangs and drug dealers.
Ledger co-founder Larchevêque condemned on X platform that France is heading towards "Mexicanization". "How many entrepreneurs, how many talents are seriously considering leaving this country that no longer protects its people?"
