France recorded a surge in crypto-related kidnappings in the first half of 2026, outpacing the total number of cases documented during all of 2025. Criminals targeting cryptocurrency holders are shifting from digital hacking to direct, physical attacks, often focusing on individuals with sizable asset holdings tied to their identities through KYC (Know Your Customer) disclosures.
Rising tide of physical crypto attacks
In early 2026, reports from both victims and authorities highlighted that attackers are increasingly abducting or assaulting crypto holders, sometimes resorting to extreme violence. In a widely reported case, David Balland, cofounder of hardware wallet firm Ledger, was abducted together with his wife. The attackers severed Balland’s finger during a €10 million ransom attempt, which ended with a rescue by French police.
In separate incidents, the families of crypto executives were physically targeted in public spaces, with some attacks captured on video and circulated widely. In May 2025, the father of an unnamed entrepreneur was kidnapped and injured during a ransom demand. Perpetrators are reportedly using KYC records—databases where exchanges and platforms store users’ verified identity and contact details—to identify, locate, and target these individuals for extortion.
Attackers often use customer information originally collected for regulatory compliance as a way to compile lists of wealthy targets they can locate and physically threaten.
By revealing portfolio snapshots or public wallet addresses on social media, some investors make themselves visible to criminals actively seeking such information. Rarely do victims realize this exposure before an incident occurs.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLKYC data leaks linked to criminal risks
KYC processes are designed to reduce fraud by requiring users to share verified details—names, addresses, identification documents, and contact numbers—during onboarding at crypto exchanges or custodial platforms. The risk emerges when these centralized repositories of personal data are breached, offering criminals everything they need to find real-world targets quickly. This critical issue was illustrated by the 2020 Ledger data breach, which exposed extensive customer data, later used in widespread phishing operations and threats against individuals known to own significant hardware wallets.
In January 2026, Waltio, a French crypto tax reporting platform, suffered a security breach affecting about 50,000 users. The exposed information included email addresses and crypto balances. Brinztech, a dark web intelligence firm, revealed that the leaked database appeared online weeks before Waltio became aware of the incident. Hackers on BreachForums claimed a direct link between stolen Waltio data and at least three kidnappings that netted $17.1 million, although French authorities have not formally confirmed these cases.
The reality, as seen in both the Ledger and Waltio cases, is that while funds were not directly stolen during these breaches, customers found themselves at personal risk of physical harm or targeted scams.
Mini dictionary: Waltio is a France-based crypto tax reporting platform known for managing capital gains and reporting requirements for digital asset holders.
Jameson Lopp, CEO of crypto wallet company Casa, described France as “the canary in the coal mine,” warning that heightened financial regulation can inadvertently create a surveillance network vulnerable to exploitation.
Scope of physical crypto attacks worldwide
According to CertiK, a blockchain security firm, there were 34 verified physical crypto attacks between January and April 2026, marking a 41% increase from the same period in 2025. Of these, Europe accounted for 82%, with France logging 24 incidents—more than its total for all of 2025. Other affected countries included the UK, US, Belgium, Hong Kong, the Philippines, Spain, and Turkey.
| Country | Physical Crypto Attacks (Jan–Apr 2026) |
|---|---|
| France | 24 |
| Other parts of Europe | 4 |
| US, UK, Asia & Others | 6 |
| Total | 34 |
French prosecutors reported a total of 77 crypto-related kidnapping incidents in the first half of 2026, compared to 45 in all of 2025. By June, French Interior Minister Laurent Nuñez stated that about 200 arrests had been made in connection with these cases. In one incident, the CEO of Paymium, a Paris-based bitcoin exchange established in 2011, saw his pregnant daughter and grandson targeted by armed attackers, but the attempt was thwarted with the help of a bystander.
Kidnapping and extortion: High-profile cases
The United States, Canada, and the United Kingdom have all witnessed severe forms of crypto-motivated violence. In New York in May 2025, John Woeltz (“Crypto King of Kentucky”) and accomplice William Duplessie kidnapped an Italian tourist, holding him for over two weeks and violently coercing him to surrender his Bitcoin credentials before police intervened. In Canada, four men infiltrated the home of a family in British Columbia while posing as postal workers, holding them hostage for over thirteen hours to extract $1.6 million in bitcoin.
In the UK, game developer and crypto investor Alex Amsel (“Sillytuna”) endured an armed robbery in March 2026. Assailants forced him to transfer about $23.6 million worth of Aave-USDC from his wallet before fleeing. The prolonged ordeal prompted Amsel to step back from the industry.
These incidents reflect how access to crypto assets can quickly translate into personal danger when sensitive information is combined with visible wealth.
“What increasingly determines whether someone keeps their crypto, or gets hurt trying to, is how much identity data is attached to it, who’s holding that data, and how carelessly it gets handled.”
Research suggests that high reporting rates in France contribute to its elevated incident count, as active investigations and strong media attention make data more available, not necessarily that France is uniquely unsafe.
Mitigation strategies and security recommendations
Security experts such as Jameson Lopp recommend advanced precautions, including establishing duress phrases with custodial providers to trigger account freezes if an account holder is under threat. Carrying a decoy wallet with minimal funds and maintaining separate wallets for varying purposes can limit potential losses in case of extortion. Avoiding the reuse of phone numbers or email addresses across platforms also reduces the risk of targeted tracking after a breach.
Exchanges and fintech services can limit long-term risk by reducing unnecessary data storage and employing verification methods that do not retain full identification documents. In case of a breach, platforms can monitor for unusual logins or large withdrawal attempts, especially from newly flagged accounts.
Victims of data leaks should remain vigilant for phishing attempts referencing breached information, as attackers may impersonate platform support to request sensitive seed phrases or additional verification steps. Enhanced withdrawal delays and dedicated risk monitoring can further protect users after exposure.
