← Back to Blog

Crypto kidnapping: 2024-2025 cases, attacker playbook, defense model

By Al Jobson · 11 min read · September 2026

Jameson Lopp's public index of physical attacks on crypto holders passed 170 documented incidents by mid-2025, with sharp spikes tied to price cycles^[1]. The New York Times and Le Monde covered a string of kidnappings in France through 2024 and 2025, including a case where the father of a Ledger co-founder was held for ransom^[2][3]. A Manhattan case in May 2025 saw a victim held for 17 days^[4]. Every one of these bypassed cryptography by attacking the human. This piece is what the pattern looks like now and what defenses actually help.

The threat, in plain terms

A crypto kidnapping is not a novel category. It is a burglary or an abduction whose objective is a cryptocurrency transfer instead of cash, jewellery, or a business ransom. What is new is the reason it targets crypto: on-chain balances are public, permanent, and (in most cases) impossible to freeze once transferred. From the attacker's perspective, a self-custody wallet is a physical safe whose combination the owner is guaranteed to know and legally able to open under duress.

The three properties that make crypto uniquely attractive to physical extortion:

• Public balance. Any Bitcoin, Ethereum, or Solana address links to a wallet whose balance is on-chain and searchable. An attacker who can tie an address to a name can quote the value before the operation begins.
• Instant settlement. A transaction to an attacker-controlled address confirms in minutes. There is no bank to call, no chargeback window, no way to reverse it.
• Weak custody perimeter. Cash and jewellery live in safes. Crypto lives on a phone or a hardware wallet the owner is carrying. The attacker does not need to breach a vault, just the owner's willingness to type a PIN.

Documented cases, 2024-2025

Two patterns hold across the data. First, the incident rate correlates with price. Every prior bull run (2017-18, 2021, 2024-25) produced a spike; every bear market brought a decline. Second, the geography clusters where two conditions overlap: significant local crypto wealth and organised-crime infrastructure capable of running a kidnap operation. France, the United States, Thailand, the UAE, Turkey, and Ukraine dominate the 2024-2025 record^[1].

How targets get selected

Target selection is the part of the operation that runs on public information. In every documented case the victim was linked to crypto wealth through at least one of the following:

• Public founder or executive profile. Exchange leaders, hardware-wallet founders, DeFi protocol builders. Their names, photos, and often their home cities are on their own websites.
• Social media proof-of-holdings. Screenshots of six-figure balances, posts about NFT purchases, "just bought" tweets, LinkedIn titles at crypto companies.
• Doxxed on-chain identity. ENS names that resolve to real names, wallet labels published on Etherscan, cross-referenced hacks of KYC databases.
• Conference speaker lists. Bitcoin, Consensus, ETHDenver, Token2049 rosters are public. Attackers watch them.
• Leaked exchange KYC. The Ledger 2020 breach exposed 270,000 customer names and physical addresses, tied to Ledger ownership by implication^[8]. Similar breaches have hit BitMEX, Celsius, and Nexo. Once a name-address-holding tuple leaks, it is priced into the target list.

The FBI IC3 explicitly warned in 2024 that on-chain analytics tools designed for compliance are also used by criminals to price potential targets before the physical operation begins^[9].

Why traditional defenses fail

The self-custody community's default answer to physical coercion has been the hardware-wallet passphrase, sometimes called the "25th word". A passphrase deterministically derives a different wallet from the same seed. In theory the victim can hand over the "small" wallet and the attacker cannot know the passphrase exists.

In practice this works for maybe 5 percent of the population that would encounter the situation. The reasons it fails for the other 95 percent:

• The attacker read the same documentation. "Now the passphrase one" is the second question a professional operation asks. Ledger, Trezor, and Coldcard all publish the feature.
• The two wallets are distinguishable. A wallet with a 25th word has a different address, a different transaction history, and often visibly different balance. A determined attacker who checks explorer history will see the mismatch.
• Under stress, story management fails. The victim has to remember which wallet they claimed had "everything", stick to the claim under interrogation, and not visibly react when the attacker asks about the specific balance the attacker already researched.
• The victim knows they cannot claim ignorance. Modern documentation is explicit that passphrases exist. Denial reads as deception.

Multisig with an offline co-signer works better because the victim can honestly say "I cannot move funds alone" and demonstrate it. This is the design Casa has offered for years and the reason its multisig product survives in a coercion threat model^[10]. The trade is setup complexity most retail users will not accept.

The wallet-level defenses that actually work

The pattern that survives under stress combines three things: a wallet the attacker sees is real and plausibly holds everything the victim owns (decoy), a mechanism that means the victim cannot move all funds unilaterally (limit, multisig, or geographic dispersion), and a silent signal that competent help is on the way (alert). No single feature solves coercion; the layered stack raises the effort-to-payoff ratio enough to change the target-selection calculus.

Wallet-by-wallet, what ships

OpSec that reduces target selection risk

The wallet layer matters. The layer above it matters more. Every documented crypto kidnapping traces back to an OpSec failure that told the attackers there was something to take. The list is boring, and every item has been ignored by a victim in a documented case:

• Do not link a real name to a public on-chain identity. Use a separate address for anything associated with your name (payroll, DAO participation, ENS with your real name). Keep holdings on unlinked addresses.
• Do not post proof of holdings. No portfolio screenshots. No "just bought" tweets. No conference talks that include your NFT collection or your address.
• Do not use ENS names that resolve to your real identity for large-balance wallets. A vanity ENS is a homing beacon.
• Assume every KYC database will leak. Ledger, Celsius, and Nexo have all leaked customer data. Use unique physical shipping addresses for hardware wallets. Consider a PO Box or a business address.
• Do not speak publicly at conferences about the size of your holdings. This has directly produced multiple documented cases.
• Home security matters. Alarm, camera coverage of entrances, hardened door, and a discreet inside-only safe are inexpensive relative to the potential loss.
• Travel patterns matter. Same route, same times, same coffee shop is target-selection gold. Vary.
• Family members are targets too. The Vaucluse and Toronto cases both involved family members held to force the crypto holder's cooperation. Family OpSec is your OpSec.
• Have a family duress word. A specific phrase used in a call or message that signals "I am not free to speak." This is standard practice in every industry with kidnap risk except, until recently, crypto.

If the worst happens: what wallet design changes

Under coercion the victim's goal is not to win; it is to reduce loss and end the incident alive. Wallet design that supports both is design that:

• Shows a plausible small balance to the attacker without revealing that a decoy branch exists.
• Forces the attacker to accept a small transfer as the total (via limits, delays, or multisig).
• Silently notifies the outside world (webhook to a monitoring service, encrypted alert to a designated contact).
• Does not require the victim to lie convincingly under stress. The wallet lies for them.

Every one of those is a design choice, not a cryptographic one. The reason so few wallets ship them is that they are UX-invasive at setup and require the vendor to think about a threat model most wallet teams avoid discussing publicly.

Bottom line

Crypto kidnapping is not a niche 2024 phenomenon. The physical-attack index is now growing at the same rate as retail on-ramp adoption, and the pattern is stable enough to plan for. The defenses that actually reduce loss under coercion are not the passphrase, not "keep quiet online" alone, and not "buy a bigger hardware wallet". They are (1) an OpSec discipline that makes target selection expensive, and (2) a wallet with design-level duress features that let the victim comply without revealing the real balance.

Every wallet vendor should be shipping duress PIN, decoy wallet, and withdrawal limits as defaults on any tier above the smallest hot wallet. Users who hold meaningful balances should be running one. The alternative is what the Lopp index already documents.

Sources

1. Jameson Lopp, "Known Physical Bitcoin Attacks." github.com/jlopp
2. Le Monde, coverage of Ledger co-founder's father kidnapping. lemonde.fr
3. The Guardian, Vaucluse crypto kidnapping report. theguardian.com
4. The New York Times, "Crypto Kidnapping in Manhattan." nytimes.com
5. Toronto Star, home-invasion crypto extortion coverage. thestar.com
6. Reuters, Thailand crypto trader torture case. reuters.com
7. Le Figaro, Paris crypto executive daughter abduction. lefigaro.fr
8. Ledger, "July 2020 data breach post-mortem." ledger.com
9. FBI IC3, "Cryptocurrency Fraud Report 2023." ic3.gov
10. Casa, multisig product docs. keys.casa
11. Coldcard, "Duress PIN documentation." coldcard.com
12. DOJ press release, Samourai Wallet founders' 2024 arrest. justice.gov
13. Chainalysis, "2025 Crypto Crime Report." chainalysis.com
14. TRM Labs, "Physical crypto attack timeline." trmlabs.com
15. Elliptic, "Ransom laundering analysis." elliptic.co
16. Cointelegraph, aggregated crypto-kidnapping timeline 2024. cointelegraph.com
17. The Block, "France's crypto kidnapping wave." theblock.co
18. CoinDesk, coverage of on-chain ransom flows. coindesk.com
19. Bitcoin Magazine, wrench-attack analysis. bitcoinmagazine.com
20. Trezor, "Passphrase feature documentation." trezor.io
21. Ledger, "Passphrase documentation." support.ledger.com
22. Interpol, "Notes on organised crime and crypto." interpol.int
23. Europol, "IOCTA report crypto-crime chapter." europol.europa.eu
24. Chainalysis, "Crypto Crime H1 2025 update." chainalysis.com
25. Verichains, industry threat notes. verichains.io
26. Wired, feature on high-net-worth crypto security practice. wired.com

Al Socrates Jobson, Co-Founder and CTO, Veyrnox LTD · ← Back to Blog