As cryptocurrencies have gained legitimacy and surged in value, violent attacks against individuals linked to the industry have risen sharply. Executives, public figures and investors are increasingly being kidnapped, assaulted or extorted by criminals seeking access to digital assets. This wave of violence has a global reach, with incidents reported across Europe, Asia, Africa and the Americas.
Crypto-related attacks between July 2024 and November 2025 constituted more than a third of all attacks reported since late 2014, with France emerging as a global hotspot with 18 recorded cases. Victims have faced extreme violence, including dismemberment and torture, in what are colloquially known as ‘wrench attacks'.
The accelerated growth in the value of cryptocurrencies is almost certainly the predominant factor in this rise. While not conclusive evidence of causation, a strong positive correlation exists between annual violent attacks and the value of the largest cryptocurrency, Bitcoin (Figure 1).[1]
As well as the surge in the value of cryptocurrencies, additional factors contributing to the rise in attacks include:
While France has become the epicenter of crypto attacks, increases in frequency and violence levels are global. Below are some notable incidents which highlight the reach and severity of these attacks.
U.S.
An assailant gained access to the residence of a crypto millionaire by posing as a courier in the Mission Dolores neighborhood of San Francisco. Upon entry, they brandished a firearm, tied up the victim with duct tape and fled with $11 million in cryptocurrency.
France
While with her two children, the wife of a crypto investor was approached and threatened by two masked individuals in the Val-de-Marne department. She was given a phone and told the family would be harmed should her husband not answer when it rang.
Pakistan
A group of four individuals, including two police officers, kidnapped a crypto trader from his home in Lahore. A ransom demand equivalent to $500,000 was made by phone to his wife, along with threats to kill him should it not be transferred.
France
During a home invasion in Suresnes, a woman was punched repeatedly in the face in front of her family as the assailants attempted to gain access to her crypto wallet.
France
The daughter of Pierre Noizat, the CEO of Paymium, and her two-year-old child suffered an attempted kidnapping in central Paris by assailants who had monitored social media to establish patterns of life. The child’s father and several bystanders intervened, derailing the attempt.
France
The father of a crypto millionaire was bundled into a van in Paris by four men, and a ransom in the region of €6 million was demanded. Although freed by police 48 hours later, one of the victim’s fingers had been severed.
U.S.
An Italian crypto investor was kidnapped and held for 17 days in Manhattan, New York. During his detention, he was subject to torture, reportedly being tased, cut with a chainsaw and set alight.
France
David Balland, a co-founder of Ledger, was kidnapped at gunpoint from his home. One of his fingers was severed and sent to a fellow co-founder to expedite a ransom.
Philippines
A Korean crypto trader was kidnapped by four individuals in Makati City. The kidnap occurred after the victim met with one of the assailants, ostensibly to discuss the selling of his car. He was held for four days before being dumped 100km away.
France
The father of a Dubai-based entrepreneur was kidnapped in eastern France. He was assaulted and doused in petrol before being dumped 700km away.
Canada
WonderFi’s CEO, Dean Skurka, was kidnapped in downtown Toronto during rush hour and forced to pay $1 million in ransom before being released physically unharmed.
Thailand
A gang of four Chinese nationals broke into a gated community and invaded the home of a compatriot in Pathum Thani. After tying up and cutting the victim, they forced him to call a relative in China to transfer $2 million in cryptocurrency.
In May 2025, French police arrested 25 suspects aged between 16–23 linked to the Pierre Noizat case. Furthermore, French Moroccan national Badiss Mohamed Amide Bajjou was detained in Morocco in June, identified as the ringleader responsible for these events, the January attack on David Balland and other incidents since 2023.
Despite these arrests, nine incidents have been reported in France since, highlighting the continued threat. Globally, assailants are even more diverse, with Chinese syndicates in Asia, fake Uber drivers in London, disgruntled ex-associates in the U.S. and romantic partners in Nigeria implicated in crypto related kidnaps.
01
The use of violence by kidnappers, which previously had not seen wide employment outside of Africa and Latin America, has become routinized. During detention and while extracting ransom, kidnappers have used tactics such as beatings, torture, the removal of fingers and dousing victims in flammables.
02
In another migration of tactics, the targeting of family members has been increasingly employed to leverage ransoms through applying additional emotional pressure.
03
Recent attacks have demonstrated that the home remains a common location for abductions to occur. This is because most individuals, including executives, spend part of each day there, maximizing the likelihood for the target to be present when a kidnapping is planned. These chances are increased further by physical and digital surveillance.
Targeting a victim’s residence often removes the need to transport victims while obtaining ransom payments, reducing the likelihood of apprehension. Additionally, as seen in many incidents, it provides assailants with a ‘secure’ location to perform extreme levels of violence, often against the target’s spouse or children, to gain payment.
Conversely, the potential ransoms available have also seen assailants expose themselves to increased levels of risk, particularly at the point of abduction. This has manifested in kidnappings occurring during daylight, in city centers and while in public view.
04
Assailants have posed as couriers, law enforcement or military personnel to isolate victims, reduce public interference and enable access. Examples include the violent assault and theft from 11 Israelis in Costa Rica, an abduction of a crypto trader in Pakistan and the kidnapping of a crypto founder in Uganda. Another common tactic is luring crypto executives, investors or traders, to fake business or romantic meetings before attempting to obtain currency through assault, kidnap or exploitation. This has been reported in France, India, Argentina, South Korea, the Philippines, Ghana and China.
05
Kidnappers worldwide have utilized social media to identify targets, establish patterns of life and track movements, as well as gain valuable information from digital business profiles. It is likely that social media would have been exploited by assailants in many cases since July 2024.
Threat actors are also increasingly using routine information — such as travel posts, tagged photos or online business schedules — to identify potential access points. As noted in Europol’s 2024 report, AI tools and unregulated apps have outpaced traditional law enforcement capabilities.
The events provide a crucial insight into the evolving security challenges faced by all corporate executives. The threats and risks identified apply to corporate executives across all sectors. The use of extreme violence is particularly concerning, with successes in obtaining ransoms and the young age of assailants making it likely criminals will continue this approach.
Adding further complexities are the range of methods to approach victims, the differing locations, demography of offenders, differences in threats globally and the growing propensity for family members to be targeted.
The requirement and depth of security provision needed for executives has increased. Risk mitigation measures can include:
As outlined by Natalie Reid, Associate Broker, Crisis Management “Crypto executives, along with their employees and family members, are now prime targets for kidnapping and extortion. This is due to their perceived wealth, limited protection and easy access to ransom funds that are hard to trace and often impossible to recover. Our special crime solutions are designed to offer not only financial protection but, most importantly, rapid crisis response. This ensures that firms and individuals are well-equipped to navigate evolving, technology-driven security threats.”
“Crypto executives, along with their employees and family members, are now prime targets for kidnapping and extortion.”
Natalie Reid | Associate Broker, Crisis Management
To find out more about how we can help navigate the complex security challenges and risks facing corporate executives, please contact our Alert:24 team via the contact details below. Alert:24 is WTW’s specialist security and crisis management advisory practice delivering intelligence, consulting, and training solutions that help identify, monitor and manage security risk.
