The Crime Wave Behind the Million-Dollar Ransom: Encryption Executives Facing "Wrench Attacks"

In addition to hacker attacks, encryption tycoons also face security threats from the real world.

Written by: Sam Schechner, Robert McMillan, Angus Berwick

Compiled by: Luffy, Foresight News

A wrench lies on the overflowing code, symbolizing encryption crime

Last Tuesday morning, shouts of "Help! Help! Help!" echoed through the narrow streets of a fashionable district in Paris.

Three masked men suddenly pounced on a 34-year-old woman, whose father is the head of the French cryptocurrency exchange Paymium. The masked men brandished a can of pepper spray and what appeared to be a firearm, attempting to force the woman and her young child into a white van disguised as a delivery truck.

But the woman's husband immediately stood between the family and the attacker, while a neighbor hurriedly carried the child away. The woman shouted, "Let me go!" The attacker struck her husband violently with a stick, and the video captured by cameras on nearby buildings showed his head covered in blood.

Then other neighbors gathered around, and a shopkeeper prepared to throw a fire extinguisher, but the would-be kidnapper jumped into the back seat of the van and fled in a hurry.

The blatant attack is the latest in a wave of violent kidnappings targeting crypto executives and their families around the world. The victims had been beaten with gun butts, kidnapped and, in two cases, had their fingers cut off.

The criminals' goal is very clear: millions of dollars in cryptocurrency ransom.

This type of attack is commonly referred to as a "wrench attack" because criminals rely on simple tools to inflict pain to coerce victims, rather than implementing theft through complex Hacker techniques.

From Digital Defense to Real Threats

For a long time, hacker attacks have been a major risk faced by cryptocurrency millionaires. However, to guard against hackers, savvy investors are increasingly storing their cryptocurrencies in offline physical devices, making remote theft more difficult. Nevertheless, real-world crypto crimes have bypassed these security measures.

"Many people have reached a level of security where they hide gold under their mattresses," said Jameson Lopp, co-founder of the Bitcoin security company Casa. "But if you are a high-profile person... you have to be vigilant against physical attacks."

This week, cryptocurrency exchange Coinbase disclosed that the personal information of up to 97,000 customers (including address and account balance snapshots) was leaked, further intensifying these concerns. The company stated that the data may have been stolen by bribed customer service contractors or employees, and it rejected a $20 million ransom demand.

Another factor stimulating crime is: the soaring value of cryptocurrencies, with Bitcoin rising 54% in the past year, creating a large number of potential high-net-worth targets.

According to government officials and industry experts, there have been at least five kidnapping cases related to cryptocurrency in France in recent months, with dozens of similar cases recorded globally over the past year. Local media reported that in July last year, an Australian cryptocurrency billionaire narrowly escaped kidnapping in Estonia after he fought off attackers disguised as painters. In March this year, a cryptocurrency influencer in Houston was attacked at home, and her husband engaged in a gunfight with intruders demanding her laptop in the middle of the night.

Some attacks were clumsy, and the criminals were quickly caught, but there are signs that organized crime groups have seen the huge profit potential in it.

"Criminals are probing to see what the return on investment for a 'wrench attack' might be," Lopp said.

Last September, a Florida man was sentenced to 47 years in prison for leading a cross-state burglary gang to rob cryptocurrency. In one of the attacks, he held a pink revolver to the head of a 76-year-old man in Durham, North Carolina, threatening to cut off his genitals. The victim ended up transferring $150,000 in cryptocurrency to the attacker, and the man was later sentenced to pay more than $500,000 in damages to the victim.

On Friday morning, French Interior Minister Bruno Retailleau convened executives from cryptocurrency companies to discuss new security measures for the industry. Retailleau stated that Tuesday's attack was similar to other recent kidnapping cases in France, with officials claiming that the mastermind recruited young criminals they had never met before through applications like Telegram and Signal, and then "remotely controlled" the execution of the plan.

"These cases are likely related," Retailleau said in a television interview.

The Cost of Showing Off Online

So far, the reported victims of the "wrench attack" are mostly related to industry celebrities, either known for their involvement in the encryption industry or for attracting attention by flaunting their wealth online.

Killian Desnos is an online gambling influencer known by the pseudonym Teufeurs, famous for his live streams on YouTube and Twitch. Prosecutors stated that in August 2023, a person disguised as an Amazon delivery driver rang the doorbell of his father's house in a small town in northwest France.

The man, along with an accomplice, forcibly dragged Desnos' father into the car and soon sent Desnos a blackmail video: the father was tied up with a gun to his head. Prosecutors said Desnos was living in Malta at the time and that he paid the ransom when he called the police. The next day, his father was rescued, and the police quickly arrested the two suspects.

"Now I realize that showing off wealth online is not a good thing," Desnos wrote at the time on the X platform.

A key issue today is how criminals identify targets in reality and how to respond.

Members of the cryptocurrency community have indicated that they have set their Instagram profiles to private and are trying to remove their and their families' addresses from public records. An executive stated that he is particularly concerned about his young children. After the attack on Tuesday, Paymium called on authorities to ease disclosure obligations, stating that data leaks could put clients at risk.

In addition to the data breach incident at Coinbase, there are two other breaches that concern investigators: The first occurred in July 2020 when the French cryptocurrency wallet company Ledger was attacked by hackers. The company produces physical devices for offline storage of cryptocurrency keys. Hackers infiltrated Ledger's database, and the names, email addresses, and mailing addresses of 272,000 customers were ultimately leaked online. The second incident involved the risk consulting firm Kroll, which was breached by hackers who obtained the addresses and other personal information of creditors in the bankruptcy proceedings of the cryptocurrency company Genesis.

Cybersecurity investigators say that the data from these two hacker attacks has circulated on criminal forums.

It has also been pointed out that a large amount of personal data has been stolen and leaked over the past decade. In France, publicly available company registration records may include the home addresses of entrepreneurs.

The security researcher Taylor Monahan from the cryptocurrency wallet company MetaMask stated that cybercriminals are skilled at pinpointing victims' addresses by cross-referencing databases or even purchasing information. This information is often publicly used to threaten and expose victims' identities, a type of cyber attack known as "doxxing."

"The younger generation is very adept at the internet and is skilled at doxxing," she said.

Some Ledger users have already complained that data leaks have exposed them to extortion and threats. In early 2021, Los Angeles cinematographer Naeem Seirafi began receiving phishing emails and texts asking him to enter his Ledger account information to verify new deposits or prevent assets from being lost due to a "vulnerability."

Afterward, someone sent him a message demanding a ransom of 0.3 bitcoins (worth about $10,000 at the time), threatening to attack his family or face it. "You hold a lot of cryptocurrency," the other person said in a text message, "I'll share this information with the bad guys in your area."

The threat became a reality: When Seirafi was out, his parents encountered a "virtual alarm" at home. Local police received a 911 call reporting that someone had opened fire on a friend at Seirafi's house. According to police reports, nearly ten officers raided his residence and confirmed it was a prank after checking.

Seirafi later joined the class action lawsuit against Ledger filed in the California district court, seeking damages. The complaint states: "For hackers, Ledger's customer list is a gold mine."

The lawyer representing the class-action lawsuit declined to comment. Ledger argued in court that Seirafi did not suffer losses from the data breach because he did not lose any funds. A spokesperson for the company declined to comment further.

"Finger: 9/10"

David Balland is one of the co-founders of Ledger and is no longer directly involved in the company's affairs. In the early hours of a Tuesday in January this year, he and his partner were kidnapped at gunpoint in their home near Vierzon in central France, French officials said.

In January 2023, French police cordoned off the scene on Mereau Street near Vierzon, France, after a kidnapping incident.

Hours later, other Ledger co-founders, including Eric Larchevêque, received a ransom message from the mastermind demanding a ransom of €10 million. People familiar with the matter said they judged the information from the T-shirt David was wearing, including a video of the attacker cutting off one of Balland's fingers.

The police negotiators communicated with the kidnapper along with Larchevêque, trying to buy time and approve an advance payment of over 1 million euros as investigators searched for the location where Balland and his partner were being held.

"This is a race against time," Paris Prosecutor Laure Beccuau later said in a television interview, "We need to rescue the two hostages and save their lives."

The police eventually tracked the kidnapper to a rental house located next to a farmland, about a 40-minute drive south from where the two were abducted. The police raided the house and rescued Balland, but his partner was not there.

"We originally thought they would be detained together, but when we found out they were separated, the situation became very tricky," said Nicolas Bacca, another co-founder of Ledger.

It was not until the next day that Balland's partner was found in a stolen van: the vehicle was located an hour and a half's drive to the north, and at that time another ransom had already been paid.

Paris prosecutor Laure Beccuau held a press conference after Balland and his partner were kidnapped

Fortunately, the mastermind demanded a ransom payment in the cryptocurrency USDT, which is pegged to the US dollar and can be frozen. The Ledger team immediately initiated a freezing plan after the hostages were released, and according to sources, they successfully recovered about 80% of the 3 million euros ransom that had been paid, and recovered more in the following days.

"We have experienced unimaginable violence," Balland posted on social media requesting privacy for his family. According to screenshots at the time, he temporarily changed his profile description on the X platform to: "Finger: 9/10".

It is currently unclear how the attacker found Balland's address. According to insiders, his home address was not exposed in the Ledger data breach.

In April this year, prosecutors filed preliminary charges against a man. According to insiders, this individual has been imprisoned on charges related to the kidnapping of Desnos's father in 2023, and it is alleged that he helped plan Balland's kidnapping while in prison. Investigators are still trying to determine if he was hired by other masterminds.

Earlier this month, the father of another Maltese crypto entrepreneur was kidnapped while walking his dog in Paris, and a ransom video showed the elderly man having one finger cut off. According to prosecutors, several people were arrested in the attack, all between the ages of 18 and 26.

In just less than half a month, another typical case has occurred.

On Tuesday, the daughter of Paymium's CEO fought hard with her husband's assistance and successfully escaped. The police stated that the "firearms" at the scene were actually toys.

Eric Larchevêque, co-founder of Ledger, 2018. Source: Bloomberg

"They are currently doing well," Paymium CEO Pierre Noizat said during a television interview last Friday when talking about his daughter and son-in-law, referring to his son-in-law as a "hero," "he stitched up a few stitches."

Noizat and other victims of the attacks stated that this wave of crime is shaking their confidence in France's ability to control criminal gangs and drug dealers.

Ledger co-founder Larchevêque condemned this week on the X platform that France is heading towards "Mexicanization." "How many entrepreneurs, how many talents are seriously considering leaving this country that no longer protects its people?"