The Crime Wave Behind Million-Dollar Ransoms: Crypto Executives Targeted in "Wrench Attacks"
TechFlow Selected TechFlow Selected
The Crime Wave Behind Million-Dollar Ransoms: Crypto Executives Targeted in "Wrench Attacks"
Besides hacking, crypto millionaires also face security threats from the real world.
Navigating Web3 tides with focused insightsBy Sam Schechner, Robert McMillan, Angus Berwick
Translation: Luffy, Foresight News
A wrench lies atop spilled code, symbolizing crypto crime
In the early morning hours last Tuesday, screams echoed through narrow streets in a fashionable Paris neighborhood: "Help! Help! Help!"
Three masked men suddenly lunged at a 34-year-old woman whose father leads the French cryptocurrency exchange Paymium. The attackers, brandishing pepper spray and an object resembling a gun, attempted to force the woman and her young child into a white van disguised as a delivery truck.
But the woman's husband immediately stepped between his family and the assailants, while a neighbor quickly grabbed the child. The woman shouted, "Let me go!" As video from building surveillance cameras showed, the attackers beat her husband with a baton, leaving him bloodied on the head.
Soon other neighbors gathered, one shop owner prepared to throw a fire extinguisher, and the would-be kidnappers jumped into the back of the van and fled.
This brazen attack is the latest in a global wave of violent kidnappings targeting cryptocurrency executives and their families. Victims have been beaten with rifle butts and abducted; in two cases, fingers were severed.
The criminals' goal is clear: millions of dollars in cryptocurrency ransom.
These attacks are commonly known as "wrench attacks" because criminals rely on simple tools to inflict pain and coerce victims, rather than complex hacking techniques to steal funds.
From Digital Defense to Real-World Threats
For years, hacking has been the primary risk facing cryptocurrency millionaires. But to guard against hackers, savvy investors increasingly store their crypto in offline physical devices, making remote theft more difficult. However, real-world crypto crimes bypass these security measures.
"Many people have reached the level of hiding gold under the mattress," said Jameson Lopp, co-founder of Bitcoin security firm Casa. "But if you're high-profile… you must be vigilant against physical attacks."
This week, cryptocurrency exchange Coinbase disclosed that personal information—including addresses and account balance snapshots—for up to 97,000 customers was leaked, further fueling concerns. The company said the data may have been stolen by a bribed customer service contractor or employee, and it rejected a $20 million ransom demand.
Another factor driving crime: surging cryptocurrency values. Bitcoin has risen 54% over the past year, creating a new wave of potential high-net-worth targets.
Government officials and industry experts say there have been at least five crypto-related kidnappings in France in recent months, and dozens of such cases documented globally over the past year. Local media reported that last July, an Australian crypto billionaire narrowly escaped abduction in Estonia after fending off attackers posing as painters. In March, a Houston-based crypto influencer was attacked at home when her husband exchanged gunfire with intruders demanding her laptop late at night.
Some attacks are clumsy, with criminals quickly apprehended, but signs suggest organized crime groups now see significant profit potential.
"Criminals are testing the return on investment of 'wrench attacks,'" Lopp said.
Last September, a Florida man was sentenced to 47 years in prison for leading a cross-state burglary ring targeting cryptocurrency. In one attack, he held a pink revolver to the head of a 76-year-old man in Durham, North Carolina, threatening to cut off his genitals. The victim ultimately transferred $150,000 in cryptocurrency to the attacker, who was later ordered to pay over $500,000 in restitution.
On Friday morning, French Interior Minister Bruno Retailleau convened a meeting with cryptocurrency company executives to propose new security measures for the industry. Retailleau said Tuesday’s attack resembled other recent kidnappings in France, where officials believe masterminds recruit young, unknown perpetrators via apps like Telegram and Signal, then remotely orchestrate operations.
"These cases are likely connected," Retailleau said in a television interview.
The Price of Online Bragging
So far, reported "wrench attack" victims have largely been tied to industry celebrities—either known for working in crypto or attracting attention by flaunting wealth online.
Killian Desnos, an online gambling influencer known as Teufeurs, gained fame through YouTube and Twitch livestreams. Prosecutors say that in August 2023, someone posing as an Amazon delivery worker rang the doorbell of his father’s home in a small town in northwestern France.
The man and an accomplice forcibly dragged Desnos’ father into a vehicle and soon sent Desnos a ransom video: his father bound, a gun pointed at his head. Prosecutors say Desnos, then living in Malta, reported the incident to police while also paying the ransom. The next day, his father was freed, and police quickly arrested two suspects.
"Now I realize that showing off wealth online isn't a good thing," Desnos wrote on X at the time.
A key question today is how criminals identify targets in the real world—and what can be done in response.
Members of the cryptocurrency community say they’ve made their Instagram profiles private and tried to remove their and their families’ addresses from public records. One executive said he is especially worried about his young children. After Tuesday’s attack, Paymium called on authorities to reduce disclosure requirements, saying data leaks could put customers at risk.
Besides the Coinbase breach, two other incidents worry investigators: First, in July 2020, French cryptocurrency wallet company Ledger was hacked. The company produces physical devices used to store crypto keys offline. Hackers breached Ledger’s database, and the names, email addresses, and mailing addresses of 272,000 customers were eventually leaked online. Second, cybersecurity firm Kroll was breached, allowing hackers to access addresses and other personal information of creditors involved in the bankruptcy proceedings of crypto firm Genesis.
Cybersecurity investigators say data from both breaches has circulated on criminal forums.
Others note that vast amounts of personal data have been stolen and exposed over the past decade. In France, publicly accessible corporate registries may include entrepreneurs’ home addresses.
Taylor Monahan, a security researcher at cryptocurrency wallet company MetaMask, said cybercriminals excel at pinpointing victims’ addresses by cross-referencing databases or even purchasing information. This data is often published to threaten or expose identities—a tactic known as "doxxing."
"Younger generations are very internet-savvy and highly skilled at doxxing," she said.
Some Ledger users have already complained that the data breach left them vulnerable to extortion and threats. In early 2021, Los Angeles film cinematographer Naeem Seirafi began receiving phishing emails and texts asking him to enter his Ledger account details to verify new deposits or prevent asset loss due to a "vulnerability."
Then, someone demanded a ransom of 0.3 bitcoins (worth about $10,000 at the time), threatening to harm his family. "You hold a large amount of cryptocurrency," the message read. "I will share this information with bad people in your area."
The threat came true: While Seirafi was away, his parents experienced a "swatting" incident at home. Local police received a 911 call claiming someone had shot a friend inside Seirafi’s house. According to police reports, nearly ten officers raided the residence before confirming it was a hoax.
Seirafi later joined a class-action lawsuit filed in California federal court against Ledger seeking damages. The complaint stated: "For hackers, Ledger’s customer list is a gold mine."
Lawyers representing the class declined to comment. Ledger argued in court that Seirafi suffered no losses from the data breach since he did not lose any funds. The company’s spokesperson declined further comment.
"Fingers: 9/10"
David Balland, one of Ledger’s co-founders who is no longer directly involved in the company, was kidnapped at gunpoint along with his partner at their home near Vierzon in central France, officials said, on a Tuesday morning in January this year.
In January 2023, French police cordon off Mereau Street near Vierzon, France, after a kidnapping
Hours later, other Ledger co-founders—including Eric Larchevêque—received ransom demands from the mastermind, calling for 10 million euros. People familiar with the case said they verified the authenticity based on David’s clothing; one message included a video of attackers cutting off one of Balland’s fingers.
Police negotiators worked with Larchevêque to communicate with the kidnappers, buying time by approving an initial ransom payment exceeding 1 million euros, while investigators searched for the location where Balland and his partner were being held.
"It was a race against time," Paris prosecutor Laure Beccuau later said in a television interview. "We had to rescue two hostages and save their lives."
Police eventually tracked the kidnappers to a rental house beside farmland, about a 40-minute drive south from where the couple was taken. Officers raided the house and rescued Balland, but his partner was not there.
"We assumed they’d be held together. When we realized they were separated, the situation became extremely complicated," said Nicolas Bacca, another Ledger co-founder.
Not until the next day was Balland’s partner found in a stolen van located an hour and a half’s drive to the north—by which time another ransom payment had been made.
Paris prosecutor Laure Beccuau holds a press conference after Balland and his partner were kidnapped
Luckily, the mastermind demanded ransom in USDT, a cryptocurrency pegged to the U.S. dollar that can be frozen. Immediately after the hostages were freed, the Ledger team initiated a freeze, and according to people familiar with the matter, successfully recovered about 80% of the 3 million euros already paid—with more recovered in the following days.
"We went through unimaginable violence," Balland posted on social media, requesting privacy for his family. At the time, screenshots showed he temporarily changed his X profile bio to: "Fingers: 9/10".
It remains unclear how the attackers located Balland’s address. People familiar with the case said his home address was not exposed in Ledger’s data breach.
In April this year, prosecutors filed preliminary charges against one man. According to sources, the individual was already imprisoned over allegations related to the 2023 kidnapping of Desnos’ father and allegedly helped plan Balland’s abduction from prison. Investigators are still determining whether he was acting on behalf of other masterminds.
Earlier this month, the father of another Maltese cryptocurrency entrepreneur was kidnapped while walking his dog in Paris. A ransom video showed the elderly man having one finger severed. Prosecutors said several suspects, aged between 18 and 26, were arrested in connection with the case.
Less than two weeks later, another textbook case unfolded.
On Tuesday, the daughter of Paymium’s CEO fought back alongside her husband and managed to escape. Police said the "gun" at the scene was actually a toy.
Eric Larchevêque, Ledger co-founder, 2018
Source: Bloomberg
"They’re doing well," Paymium CEO Pierre Noizat said during a television interview last Friday, referring to his daughter and son-in-law, whom he called a "hero." "He needed a few stitches."
Noizat and other attack victims say this crime wave is shaking their confidence in France’s ability to control criminal gangs and drug traffickers.
Ledger co-founder Larchevêque criticized France this week on X, warning the country is headed toward "Mexicanization." "How many entrepreneurs, how much talent, are seriously considering leaving a nation that no longer protects its people?"
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
