Crypto Kidnapping (Wrench Attack): How It Works, Warning Signs & What To Do

Physical violence or threats used to force victims to transfer cryptocurrency.

Crypto kidnapping, also known as a 'wrench attack,' involves criminals using physical violence, threats, or kidnapping to force victims to transfer cryptocurrency or reveal private keys. Attackers often target known cryptocurrency holders identified through social media posts, blockchain transaction analysis, or leaked databases. Unlike digital hacks, these attacks exploit the irreversible nature of cryptocurrency transactions and the victim's physical vulnerability. Attacks can involve home invasions, kidnapping, assault, or extortion with threats of harm to the victim or their family. High-profile cases have involved mutilation and demands for millions in ransom.

How It Works

  1. 1Criminals identify cryptocurrency holder through social media, leaked data, or blockchain analysis
  2. 2Research victim's address, routine, and security measures
  3. 3Confront victim through kidnapping, home invasion, or ambush
  4. 4Use violence or threats of violence to coerce victim into transferring crypto
  5. 5Force victim to access wallets, reveal seed phrases, or make transfers
  6. 6May hold victim until transfer confirms or until ransom is paid
  7. 7Dispose of victim or release them after obtaining funds

Warning Signs (Red Flags)

  • Someone asks specific questions about your cryptocurrency holdings
  • Unusual surveillance or vehicles near your home
  • Strangers who seem to know details about your crypto activities
  • Being followed after cryptocurrency meetups or events
  • Receiving threats demanding cryptocurrency transfers
  • Data breach exposes your identity as a cryptocurrency holder

What To Do If Targeted

  • Call emergency services (911 in US) immediately if you're in danger
  • Comply with immediate physical demands to protect your safety
  • Report to local police as soon as safe to do so
  • Report to FBI at local field office and IC3 (https://www.ic3.gov)
  • Contact cryptocurrency exchanges to freeze or trace stolen funds
  • Seek medical attention for any injuries
  • Consider relocating temporarily if threats continue
  • Work with law enforcement on investigation and victim support services

Real Cases

Ledger Co-Founder David Balland Kidnapping

Alleged
📅 January 21-23, 2025💰 Approximately €10 million demanded; portion paid, nearly all traced/frozen/seized

David Balland, co-founder of Ledger, was kidnapped on January 21, 2025, and held for approximately 48 hours. During captivity, one of his fingers was mutilated. The attackers demanded approximately €10 million in cryptocurrency. According to the Paris prosecutor, part of the ransom was paid, but nearly all of it was traced, frozen, or seized. Three suspects were arrested by March 2026, but charges against them remain alleged with no verdict.

View Official Source

Frequently Asked Questions

How can I protect myself from physical crypto attacks?

Don't publicly discuss cryptocurrency holdings on social media or at events. Use privacy-focused practices to obscure wallet ownership. Consider multisignature wallets that require multiple parties to authorize transactions. Keep most holdings in cold storage at undisclosed locations. Avoid patterns in your routine. If you hold significant amounts, consult with personal security professionals.

Should I comply with physical threats to transfer cryptocurrency?

Your physical safety is the priority. Law enforcement and security experts generally advise complying with immediate demands during violent confrontations. Cryptocurrency can potentially be traced and recovered; your life cannot. Contact law enforcement immediately after the threat ends. Many sophisticated holders maintain 'decoy' wallets with smaller amounts for this scenario.

Can transferred cryptocurrency be recovered after a wrench attack?

Sometimes. Law enforcement has successfully traced and frozen cryptocurrency stolen in kidnapping cases, especially when reported quickly. Blockchain analysis firms can track transfers across wallets and exchanges. However, recovery depends on how quickly funds are reported, whether they pass through exchanges that cooperate with law enforcement, and whether they're mixed or laundered. Report immediately to maximize recovery chances.

See a Scam? Report It

Report suspected scams to law enforcement to help protect others and aid investigations.

Report a ScamFBI IC3FTC ReportFraud