Physical attack archive

Crypto wrench attacks on holders

Self-custody removes counterparty risk, but it shifts the attack surface from the exchange to you. This is a chronological record of documented $5-wrench attacks — home invasions, kidnappings, mutilations and coerced transfers — targeting crypto holders worldwide.

22
Incidents tracked
13
Countries affected
2017–2026
Years covered
1
Murder cases

All incidents, latest first

HighArmed Robbery

Crypto trader

Location:Houston, Texas, USA
Date:June 9, 2025
Loss / demand:~$1.2M

Trader was followed home from an OTC meeting, held at gunpoint and forced to drain a hot wallet and his MetaMask seed phrase backup.

Outcome
Houston PD opened an investigation; partial on-chain freeze via Tether and Circle.
CriticalTorture / Mutilation

Michael Valentino Teofrasto Carturan

Location:New York City, USA
Date:May 23, 2025
Loss / demand:Wallet password targeted

Italian crypto investor held for 17 days in a Manhattan townhouse, tortured with electric shocks and dangled from a rooftop to force him to surrender his Bitcoin wallet keys.

Outcome
Victim escaped. John Woeltz and accomplices arrested and charged with kidnapping and assault.
MediumAbduction (Family Member)

Father of Pierre Noizat (Paymium CEO)

Location:Paris, France
Date:May 13, 2025
Loss / demand:Ransom demanded, not paid

Masked men attempted to force a man and his daughter into a van in broad daylight in the 11th arrondissement. The family fought back and bystanders intervened.

Outcome
Abduction failed. Five suspects later arrested by French police.
MediumAbduction (Family Member)

Father of crypto influencer (Mougins)

Location:Vesoul / Mougins, France
Date:May 1, 2025
Loss / demand:€5–7M ransom demanded

Father of a French crypto entrepreneur was kidnapped and held in a van. Captors cut off part of one of his fingers to pressure the family for a multi-million-euro ransom in crypto.

Outcome
Rescued by French police within days; multiple arrests across France and Morocco.
MediumAbduction (Family Member)

Crypto influencer's parents

Location:Belgium
Date:March 14, 2025
Loss / demand:Crypto ransom demanded

Parents of a Belgium-based crypto influencer were targeted in a violent abduction attempt at their home; attackers fled when neighbours intervened.

Outcome
Police-protected; multiple suspects under investigation linked to France network.
MediumAbduction (Family Member)

Father of crypto millionaire

Location:Le Vésinet, France
Date:January 25, 2025
Loss / demand:€5M ransom demanded

Father of a French crypto entrepreneur was abducted from his home; captors demanded a multi-million-euro crypto ransom.

Outcome
Rescued by French police after a few days; suspects arrested.
CriticalTorture / Mutilation

David Balland (Ledger co-founder)

Location:Méreau, France
Date:January 21, 2025
Loss / demand:~€10M ransom demand

Balland and his partner were kidnapped from their home. Attackers cut off one of his fingers and sent the video to Ledger CEO Pascal Gauthier to coerce a crypto ransom payment.

Outcome
GIGN rescued both victims within 48 hours. Ten suspects arrested; ransom not paid.
MediumHome Invasion

Crypto holder (Saint-Maur-des-Fossés)

Location:Île-de-France, France
Date:January 11, 2025
Loss / demand:Forced wallet transfers

Armed intruders broke into a family home, restrained the residents and forced them to log in to crypto exchanges and self-custody wallets.

Outcome
Part of a wider France-wide crackdown on crypto-targeted home invasions in early 2025.
HighKidnapping

Dean Skurka (WonderFi CEO)

Location:Toronto, Canada
Date:November 1, 2024
Loss / demand:C$1M ransom paid

Skurka was pulled into a vehicle in downtown Toronto and released after a ransom was wired electronically.

Outcome
Released same evening. Police investigation ongoing.
MediumKidnapping

Crypto entrepreneur

Location:Hyderabad, India
Date:July 31, 2024
Loss / demand:~$230K

Businessman was abducted by men posing as CBI officers and forced to transfer USDT from his wallets before being released.

Outcome
Telangana cyber-crime unit arrested multiple suspects.
HighHome Invasion

Crypto investor

Location:Florida, USA
Date:July 3, 2024
Loss / demand:~$4M

Home invasion crew tied up the victim and his family in their Florida home and forced him to transfer ~$4M in BTC and ETH to attacker-controlled wallets.

Outcome
FBI investigation; funds traced through mixers.
MediumHome Invasion

Crypto holder

Location:Sentosa, Singapore
Date:April 14, 2024
Loss / demand:Targeted attack

Intruders broke into a luxury home on Sentosa Cove targeting the owner's crypto holdings; victim restrained while wallets were accessed.

Outcome
Singapore Police Force investigation; victim survived with non-life-threatening injuries.
MediumHome Invasion

Bitcoin OG (Toronto)

Location:Toronto, Canada
Date:March 16, 2024
Loss / demand:Family threatened

Three masked intruders broke into the home of an early Bitcoin investor, restraining family members and demanding access to hardware wallets.

Outcome
Family unharmed thanks to a passphrase-protected wallet. Toronto Police investigation ongoing.
CriticalArmed Robbery

Bo Shen (Amber Group / Fenbushi founder)

Location:(Hot-wallet compromise tied to physical threat)
Date:November 11, 2022
Loss / demand:~$42M

Shen disclosed that ~$42M in crypto was stolen from his personal wallets in a targeted attack; the funds were drained in highly coordinated transfers.

Outcome
On-chain tracing ongoing; no full recovery reported.
HighKidnapping

Crypto trader

Location:Dubai, UAE
Date:September 23, 2022
Loss / demand:~$500K

Trader was lured to an in-person OTC deal, abducted in a van, beaten and forced to transfer USDT before being released in the desert.

Outcome
Dubai Police arrested multiple suspects; partial recovery via Tether freeze.
MediumArmed Robbery

Bitcoin holder

Location:Hong Kong
Date:June 11, 2022
Loss / demand:~HK$3M

Victim was lured to a Wan Chai apartment for an in-person OTC trade. He was beaten and forced to transfer Bitcoin to attackers.

Outcome
Hong Kong Police arrested several suspects; partial recovery.
MediumHome Invasion

Zaryn Dentzel (Tuenti founder)

Location:Madrid, Spain
Date:September 2021
Loss / demand:Crypto access targeted

Dentzel was tied up and beaten in his Madrid home by intruders who demanded access to his cryptocurrency holdings.

Outcome
Dentzel survived; Spanish police investigation ongoing, no full recovery.
CriticalArmed Robbery

Crypto investor

Location:Mumbai, India
Date:August 14, 2021
Loss / demand:~₹80 crore

Investor Shailesh Bhatt alleged he was abducted by police officers who extorted Bitcoin and Ethereum from him over multiple days.

Outcome
CID Gujarat arrested several officers; landmark case in Indian crypto extortion law.
CriticalMurder

Anne-Elisabeth Falkevik Hagen

Location:Lørenskog, Norway
Date:October 31, 2018
Loss / demand:€9M Monero ransom demand

Wife of one of Norway's wealthiest investors disappeared from her home. A ransom note demanded payment in Monero. Case became Norway's most high-profile crypto-linked crime.

Outcome
Husband Tom Hagen was arrested in 2020 on suspicion of murder; case remains unresolved.
HighArmed Robbery

Crypto investor (Manhattan)

Location:New York City, USA
Date:February 5, 2018
Loss / demand:~$1.8M ETH

Investor was forced at gunpoint by an acquaintance into transferring ETH from his Authy-secured account during a meeting.

Outcome
Suspect arrested by NYPD shortly after; funds partially traced.
MediumHome Invasion

Bitcoin trader (Oxford, UK)

Location:Moulsford, Oxfordshire, UK
Date:January 21, 2018
Loss / demand:Forced transfer attempted

Four armed men in balaclavas broke into a trader's home, threatened his pregnant wife at gunpoint and forced him to transfer Bitcoin from his accounts.

Outcome
Family unharmed; investigation by Thames Valley Police, no public arrests.
HighKidnapping

Pavel Lerner (Exmo analyst)

Location:Kyiv, Ukraine
Date:December 26, 2017
Loss / demand:$1M BTC ransom

Lerner was forced into a black Mercedes outside the Exmo office. Captors held him until a Bitcoin ransom was paid.

Outcome
Released after several days; Lerner declined to detail the incident publicly.

How to harden yourself against a wrench attack

  • Use a passphrase (25th word). A hardware wallet with a passphrase gives you a plausibly-deniable decoy wallet that holds a small amount, while your real funds sit behind a passphrase only you know.
  • Never flex on-chain or on social media. Almost every targeted attack on this list started with the attacker knowing the victim was wealthy in crypto — through Twitter, Telegram, or leaked exchange data.
  • Split custody. Multi-sig (e.g. 2-of-3 across geographic locations) means no single coerced signature can drain your funds.
  • Treat OTC trades as physical-security events. Many incidents — Hong Kong, Dubai, Houston — started with an in-person OTC meeting. Use regulated venues only.
  • Keep KYC data minimal. The 2022 Ledger data leak and multiple exchange breaches have fed name + address lists straight to organised crime groups now operating across Europe.

Pick a wallet that supports passphrases & multi-sig

Our hardware wallet comparison ranks devices by Secure Element design, passphrase support, multi-sig friendliness and supply-chain practices.

See the full comparison →

Incidents compiled from Jameson Lopp's physical-attack registry, court filings, Reuters, AFP, AP, Le Monde, The Block, CoinDesk and local police statements. This page tracks publicly disclosed cases and is not exhaustive.