Crypto-related physical attacks — kidnappings, home invasions, and ransom extortion — reached 34 verified incidents globally in the first four months of 2026, a 41% increase over the same period in 2025, according to blockchain security firm CertiK. Estimated losses hit $101 million across ransom...
"41 kidnappings of crypto holders in France in 3.5 months of 2026. Why? French tax officials selling crypto owners' data to criminals. Now the state also wants IDs and private messages of social media users. More data = More victims." — Pavel Durov, Founder, Telegram
Crypto-related physical attacks — kidnappings, home invasions, and ransom extortion — reached 34 verified incidents globally in the first four months of 2026, a 41% increase over the same period in 2025, according to blockchain security firm CertiK. Estimated losses hit $101 million across ransom payments, frozen funds, and failed demands. CertiK projects the year will close with approximately 130 incidents, which would mark a record.
Europe accounts for 82% of all recorded attacks (28 of 34), with France alone reporting 24 documented public incidents — already surpassing the 20 logged for all of 2025. The French Interior Ministry counts 41 kidnappings or attempted abductions linked to cryptocurrencies since January 1, 2026, a rate of one every 2.5 days. On May 20, the wife of Sébastien Borget, co-founder of The Sandbox, narrowly escaped an attempted kidnapping at their home in Villenoy, Seine-et-Marne, when neighbors intervened.
The surge correlates directly with the expanding surface area of leaked personal data. A former French tax official, Ghalia C., was arrested in June 2025 on charges of using government fiscal software to extract addresses, net worth, and crypto holdings of citizens, then selling the data to organized crime. Separately, KYC verification provider IDMerit exposed approximately one billion personally identifiable records across 26 countries in November 2025, including names, addresses, national ID numbers, and verification logs. As on-chain protocol security improves, attackers have shifted to the lowest-cost vulnerability: the physical person holding the keys.
CertiK's 2026 Wrench Attacks Overview documents the following pattern:
| Metric | Jan–Apr 2025 | Jan–Apr 2026 | Change | |--------|-------------|-------------|--------| | Verified incidents (global) | 24 | 34 | +41% | | Estimated losses | ~$41M (full year 2025) | ~$101M (4 months) | — | | European share of attacks | ~55% | 82% | +27 ppts | | France-specific incidents | ~8 (pro-rated) | 24 | ~3x |
The 2025 full-year total was 72 confirmed incidents worldwide, itself a 75% increase from 2024. CertiK notes a 250% increase in physical assaults over two years. If the current trajectory holds, the firm projects approximately 130 incidents by year-end 2026.
These figures are widely considered understated. Many kidnappings and ransom payments are resolved privately and never reported. The French National Directorate of the Judicial Police counts 135 crypto-linked kidnapping incidents in France alone since 2023, a figure substantially higher than CertiK's global public database.
Attack profiles have shifted. CertiK describes the transition from opportunistic crime to "organized, transnational groups that combine OSINT-driven targeting, social engineering, and extreme physical violence to extract private keys." Family members are increasingly targeted — a trend confirmed by multiple 2026 incidents.
France accounts for nearly 80% of European crypto-related physical attacks, according to the National Directorate of the Judicial Police. The country has logged 41 kidnappings or attempted abductions linked to cryptocurrencies since January 1, 2026.
Key incidents in the timeline:
January 2025: Ledger co-founder David Balland and his wife kidnapped in Vierzon. Attackers severed one of Balland's fingers and sent a video to Ledger associates as part of a ransom demand for 100 BTC (~$10 million). Police rescued both hostages and arrested 10 suspects, aged 20–40, who face life imprisonment. The final suspect was apprehended in a joint French-Spanish operation in March 2025.
2026 (various): An unnamed crypto entrepreneur's wife and 11-year-old child were kidnapped, with attackers demanding €400,000. The incident was resolved by police.
May 20, 2026: Six suspects used a fake delivery ruse to attempt to kidnap the wife of Sébastien Borget, co-founder and COO of The Sandbox, at their home in Villenoy. A man wearing a branded delivery vest approached with a cardboard box. Neighbors intervened, and two teenage suspects — Mateo V. (born 2010) and Walid H. (born 2009), both from Pantin, Seine-Saint-Denis — were arrested carrying a fake handgun, zip-tie restraints, and balaclavas. Four suspects remain at large.
The age of the arrested suspects in the Borget case is notable: both were born in 2009 and 2010, making them 15 and 16 years old. French prosecutors have now charged 88 individuals in connection with crypto kidnapping cases, including minors.
The French case exposes a systemic weakness: the pathway from regulatory compliance data to criminal targeting lists.
Government data leaks. Ghalia C., a 32-year-old French tax official, was arrested in June 2025 and charged with illegally accessing the government's "Mira" fiscal software — a platform containing the addresses, net worth, and crypto holdings of French citizens — and selling the extracted data to organized crime networks. Prosecutors allege the information enabled criminal syndicates to build precise target lists of wealthy crypto holders.
Telegram founder Pavel Durov publicly linked the kidnapping surge to these leaks, stating that French tax officials were "selling crypto owners' data to criminals" while the government simultaneously sought expanded access to citizens' social media data through new surveillance legislation.
KYC vendor breaches. The IDMerit data leak, discovered by Cybernews in November 2025, exposed approximately one billion KYC records from a single identity verification provider. The unprotected MongoDB database contained full names, addresses, national ID numbers, dates of birth, phone numbers, email addresses, telecom metadata, and KYC/AML verification logs across 26 countries. The United States was the most affected nation, with over 203 million personal records exposed. IDMerit, a California-based firm, serves financial services and fintech platforms — including crypto exchanges that outsource identity verification.
Most large crypto exchanges do not maintain in-house KYC infrastructure. They rely on third-party vendors. A single breach at the vendor level compromises the user data of dozens of platforms simultaneously, creating a concentrated target database for criminal organizations.
The Coinbase insider breach, disclosed via SEC 8-K filing in May 2025, illustrates the vendor risk chain at scale. Cybercriminals bribed overseas customer support contractors to access Coinbase's internal tools, exfiltrating data on approximately 69,461 customers. Compromised information included names, email addresses, phone numbers, and in some cases, images of government-issued identification documents.
Coinbase estimated remediation and reimbursement costs at $180 million to $400 million. The company refused to pay a $20 million ransom demand and instead established a $20 million reward fund for information leading to arrests. An arrest was made in India.
The breach is directly relevant to the physical attack pipeline. Stolen KYC data — particularly government ID images combined with residential addresses — provides exactly the information organized crime groups need to plan physical coercion attacks. Coinbase CEO Brian Armstrong's personal security costs reached $7.6 million in 2025, a 20%-plus increase from the prior year, exceeding what major Wall Street banks typically disclose for their CEOs.
The physical threat environment has created measurable demand for executive protection services. According to Bloomberg, crypto conferences have increased security presence, with many high-profile speakers at the Bitcoin 2026 conference in Las Vegas moving through venues with personal bodyguards.
| Company | Security Spend (2025) | Notes | |---------|----------------------|-------| | Coinbase (CEO Armstrong) | $7.6M | 20%+ increase YoY; exceeds major Wall Street bank CEO security | | Gemini (Winklevoss twins) | ~$2.5M each | New 2026 agreement: $400K/month plus expenses for family coverage |
Executive Risk Services, an executive protection firm serving the digital asset industry, reported client inquiries increased from approximately once per quarter two years ago to once per week in 2026.
Private security spending in crypto is beginning to structurally alter the cost profile of operating in the industry. For publicly traded companies, security costs now constitute a material line item disclosed in proxy filings. For individual holders, the economic calculation shifts: the cost of securing physical safety may approach or exceed the yield generated by holdings, particularly for mid-tier portfolios.
At Paris Blockchain Week on April 15–16, 2026, Jean-Didier Berger, France's Minister Delegate to the Interior Ministry, announced a series of protective measures:
A more comprehensive strategy is being developed with Interior Minister Laurent Nuñez, expected in the coming weeks. France has charged 88 suspects in connection with crypto-related kidnapping cases.
The policy tension is visible: France simultaneously promotes Paris as a competitive crypto hub — hosting major industry events and courting institutional adoption under MiCA — while dealing with a physical security crisis that may deter precisely the entrepreneurs and investors the country seeks to attract.
The wrench attack epidemic exposes three structural tensions in the crypto ecosystem:
1. KYC mandates create attack surfaces. Regulatory requirements to collect and store personal identification data — intended to prevent financial crime — generate concentrated databases that, when breached, enable precisely the physical crimes they ostensibly help prevent. The CertiK report notes: "As long as crypto-asset holdings remain associated with identifiable financial data, physical coercion will remain the economically most rational attack path."
2. Security costs alter economic viability. For exchanges, the cost of securing customer data and executive personnel is now a material operating expense. For individual holders, physical security costs represent a new category of "cost of capital" that does not exist in traditional finance, where custodial institutions absorb these risks. This changes the economic value equation for self-custody.
3. The attacker's calculus favors physical over digital. On-chain security has improved substantially: smart contract audits are standard, multi-sig and MPC wallets are widespread, and protocol exploits are declining relative to TVL. As digital attack vectors close, the cost-benefit ratio shifts toward physical coercion — particularly when KYC data makes target identification trivial.
The crypto industry's security problem has migrated from code to flesh. On-chain exploits are declining relative to ecosystem size, while physical coercion attacks are accelerating. The common denominator across the 2026 case file — from the Ledger co-founder's severed finger to the teenage suspects carrying zip ties to Sébastien Borget's front door — is data. Attackers do not need to break cryptography. They need a name, an address, and an estimate of holdings. Regulatory compliance databases, government fiscal records, and third-party KYC vendors provide all three.
The industry now faces a cost that does not appear on any protocol's fee schedule: the price of physical safety. For exchanges, that cost is disclosed in proxy filings. For individuals, it is borne privately or not at all. The economic implication is straightforward: an asset class that requires its holders to budget for armed protection operates under a fundamentally different risk model than one that does not.