If you own a large amount of real estate, it's almost impossible for someone to come with a gun and take it away. But if you own a string of easily transferable, globally cashable cryptocurrencies, that is like a perfect walking ATM for criminals.
According to incomplete statistics from Rhythm BlockBeats on public cases, there were about 7 incidents of "physical layer" cryptocurrency kidnappings, home invasions, or violent threats in 2022; by 2023, this number had at least doubled to about 15-18; and in 2024, it continued to grow, with at least 20 recorded incidents, and the average amount involved in each case was higher, with several cases involving ransom or losses exceeding one million dollars; in the first half of 2025 (up to June), at least 34 incidents had occurred, far surpassing last year's record high.
The vast majority of cases belong to the typical "wrench attack," where even the most secure cold wallets and cryptographic defenses cannot withstand a knife, a wrench, or a stun baton. (This term comes from a famous XKCD comic: when complex cryptographic protections are faced with physical violence, all it takes is a wrench to make you obediently hand over your private key.)
Typical methods of these wrench attacks include: breaking and entering, armed threats or binding torture to force the victim to hand over mnemonic phrases or transfer funds; disguising as police, agents, insurance personnel, Uber drivers, etc., to trick the victim into a confined space before attacking; using acquaintances or sexual seduction to set up ambushes, meeting in hotels, apartments, or cars; organized gangs operating transnationally, such as South Asian gangs in Southeast Asia, Russian gangs in Thailand, and Ugandans impersonating military or police.
The Bali Tragedy: A Deadly Trap in Paradise
When it comes to cryptocurrency-related kidnapping cases, most people's first impression is the Bali couple tragedy, a case that caused quite a stir in both the crypto and tourism circles.
On May 1, 2023, at a five-star hotel in Bali, Indonesia, a 22-year-old Chinese couple on vacation was found dead under horrific circumstances.
According to the Indonesian police's investigation of 31 witness testimonies and forensic examinations, the official conclusion was relatively simple and direct: the male victim first strangled his girlfriend, then stabbed himself with a beer bottle until he was bloodied, and finally took his own life. The police stated that the couple had quarreled over some personal issues before arriving in Bali, and the male victim had also sustained an injury to his left hand, so from the police's perspective, this was a typical "murder-suicide."
However, there was a detail that caused this case to explode in the crypto community—rumors suggested that the deceased was involved in the crypto space, and the male victim might have held cryptocurrencies worth approximately 200 million RMB.
Discussions in the crypto community at the time
A crypto trader with the WeChat name "nnn" spoke out about the incident, claiming the male victim was his friend and they had chatted about half a month prior.
Before the official determination of the case as a "murder-suicide," most in the crypto community speculated that someone had targeted this money, wanting to force him to hand over his wallet keys, and thus the suspect resorted to extrajudicial measures against the couple to extract the password, resulting in both victims being lost and the money disappearing.
However, many details about the case were dug up online, such as why the couple checked in separately, with the hotel room registered under the female's name? The first thing the male victim did upon entering the hotel room was repeatedly check the adjacent room and the hallway—was he afraid someone would sneak in through a hidden passage or window? There were no fingerprints found on the beer bottle, as if a professional hitman had cleaned up after the job. Additionally, in a leaked photo of the male victim, he had a small braid, giving off a "gangster vibe." People in the community noted that this kind of demeanor and appearance is commonly seen among certain gangs in Southeast Asia or Hong Kong and Taiwan.
These numerous details led to a widely circulated version of the case: in this "gambling" base and electronic fraud zone in Southeast Asia, it is common to use USDT or various cryptocurrencies to transfer and "clean" money. This young man, holding a large sum, allegedly took the money from the "boss" under the pretense of "cleaning" it. Several local OTC traders sold his whereabouts while helping him exchange USDT for dollars. Upon discovering the money was missing, the "boss" offered a huge bounty to "make an example," and professional hitmen traced him to the hotel and struck. The method of attack was entirely consistent with gang revenge operations. The "boss" was not a small player; he might have backing from some warlords and corrupt officials in Southeast Asia, and fearing that publicizing the case would scare away a large number of foreign tourists, the local government preferred to suppress it.
Of course, this is just a speculative version circulating in the community and may not reflect the true nature of the case. However, due to the mysterious nature and brutal severity of the incident, it has remained very famous in the crypto community. RIP…
According to locals in Indonesia, this case hardly made any waves locally; the hotel was perfectly fine and continues to thrive. To this day, it is still regarded as a luxurious vacation destination. The sea breeze of Bali has blown through too many news stories related to cryptocurrency kidnappings, cold and detached, with no connection to the sunshine of a vacation paradise.
For example, in early 2023, there was a rumor circulating in the crypto community: a crypto blogger named Yuri Boytsov was being targeted. At that time, he had rented a seaside villa in Bali, teaching people how to trade cryptocurrencies on Telegram during the day and enjoying beers by the sea at night. One night, four people suddenly burst into his room, one of whom was wearing a police uniform, while the other two were white men with masks. Without saying a word, they pinned him to the ground, stole his phone and passport, and then forced him to unlock his wallet, forcibly transferring away $284,000 worth of Bitcoin. Later, the Indonesian police only managed to catch one suspect, who claimed Yuri was a scammer and deserved to be robbed. In the end, the money was never recovered, and Yuri left in disgrace for another country.
An even older case occurred at the end of 2021, when an Italian couple staying in a villa in Seminyak was awakened at 3 AM by several people breaking in. The assailants were dressed in black, wearing gloves and masks, first tying up the male victim, holding a knife to his neck, and sealing his mouth with tape, then demanding his phone password. If he did not cooperate, they would switch to various forms of beating and threats. In the end, their Bitcoin accounts and six mobile phones were completely emptied, amounting to about $374,000. Afterward, the police discovered that two of the foreign suspects had previously dined and partied at the victims' home; currently, the police had only arrested two of them, while the remaining Polish and Russian suspects were still wanted.
Debt Repayment: A Case Within a Case of Kidnapping and Theft
On August 25, 2024, on a hot and irritating Sunday afternoon, in an upscale community in Danbury, Connecticut, the lawns were neatly trimmed, and freshly cleaned outdoor loungers were set up by the pool. Most residents here are stable and wealthy, making kidnapping incidents quite rare; a police officer might encounter only one in their lifetime.
Sushil was a vice president at Morgan Stanley; although his salary was high, it wasn't shockingly so. That day, Sushil and his wife were driving their newly purchased Lamborghini, looking at houses in the neighborhood. However, this middle-class couple had no idea that a terrifying nightmare was about to unfold in the next few minutes.
As they turned a corner, a white Honda suddenly slammed into the back of Sushil's Lamborghini. Sushil instinctively hit the brakes and was about to get out to check what happened when another white truck came barreling towards them, completely blocking the Lamborghini. Within seconds, six masked men in black rushed out from the front and back vehicles. They hardly gave the couple time to react; the car doors were yanked open, and the couple was pulled out. Sushil shouted and struggled desperately, only to be met with a baseball bat that struck him hard on the head, instantly covering half his face in blood.
The couple was dragged into the back of the truck, tightly bound with tape, wrapped up like mummies, with their mouths taped shut, unable to move their hands and feet, and could only breathe through a small gap in their noses. The truck made a U-turn and sped off, just like in the movies. But while movies are scripted, the couple's fear and suffocation were real, with the metal truck shaking violently, and the kidnappers occasionally hitting them with the baseball bat, each blow causing excruciating pain.
What the kidnappers did not expect was that an off-duty FBI agent happened to witness everything nearby and immediately reported the truck's license plate number to the local police. Within ten minutes, a patrol car intercepted the truck. Seeing the situation was not good, the driver began to flee wildly, running red lights and scraping against curbs, creating sparks everywhere. After about a mile, the vehicle finally lost control and crashed hard into a roadside barrier. Four kidnappers jumped out of the vehicle and fled into the woods and under the bridge, ultimately being subdued by the police.
The rescued couple was injured all over, with their legs still bound by tape and their faces covered in blood. Strangely, law enforcement discovered that the suspects, aged between 18 and 26, had rented a car in Miami specifically to drive to Connecticut. The distance from Miami to Connecticut is about 2,100 kilometers, requiring at least 20 hours of non-stop driving. What could this couple possibly have that would warrant a group of people traveling from Florida to Connecticut to kidnap them? Sushil was just an investment banking executive; while his salary was high, if they were after money, they could have just stolen the car—why go through the trouble of a kidnapping?
The truth slowly pieced together afterward. The police examined several suspects' phones and looked at their group chats, discovering that the real target of this group was not the couple but their son—Veer Chetal, an 18-year-old high school graduate, which even led to a $250 million cryptocurrency theft case.
Veer Chetal, photo provided by the U.S. Marshals Service in March 2025
Chetal's identity was not simple; during the day, he attended Rutgers University in New Jersey, but at night, he was a crypto thief.
Last August, Chetal and several friends he met in the Minecraft black market formed a "cybercrime group," using an old but effective social engineering trick to impersonate customer service from Google and the cryptocurrency exchange Gemini, transferring 4,100 Bitcoins from an early Bitcoin player in Washington in batches, worth $250 million at the time, and as of the time of writing, worth $420 million.
After getting the money, Chetal and his group lived a lavish lifestyle: spending millions on cars, jewelry, renting luxury homes, and partying at nightclubs. He drove a Lamborghini to school, frequently went to nightclubs, swapped luxury cars, and attended parties one after another.
It was at a nightclub in Miami that the young and impulsive Chetal had a dispute with one of the kidnappers, which ultimately escalated into a physical confrontation. The kidnappers then learned that Chetal possessed a large amount of cryptocurrency, so they flew from Florida to Connecticut, planning to first capture his parents as hostages and then force Chetal to hand over the remaining money—this was the afternoon when the Lamborghini was rear-ended.
Chetal was connected to at least dozens of similar small to medium-sized scams, with smaller ones amounting to tens of thousands of dollars and larger ones reaching two to three million dollars. The police found $500,000 worth of luxury goods, jewelry, cash, and $39 million in cryptocurrency during a search of his home.
According to court documents released this week, Chetal has pleaded guilty and agreed to testify in exchange for a reduced sentence, potentially facing around 20 years in prison. Born in India, Chetal came to the United States with his family in 2010 at the age of four, obtaining a dependent visa due to his father's foreign worker visa, but he may be deported due to this criminal case. Chetal's father also lost his job at Morgan Stanley because of this incident.
The Lamborghini, once a symbol of status, now sits alone in a Connecticut police parking lot.
Hal Finney's Last Extortion Call
If there is anyone in the Bitcoin community recognized as a "white moonlight," Hal Finney would undoubtedly be on that list. Even though he denied being the founder of Bitcoin, many believe he is Satoshi Nakamoto.
He was the first person to receive a Bitcoin transfer from Satoshi, one of the earliest to understand Bitcoin, and a very early contributor of Bitcoin's computing power and code. Yet, in the last few months of his life, this individual could not leave the world quietly.
Hal Finney with his wife Fran
It was the winter of 2014, and Hal Finney had been battling ALS for five years, losing most of his bodily functions, with swallowing becoming a dangerous act. His wife Fran had to suction his throat, wash him, and change his tubes every day. One morning, while she was bathing Hal with a caregiver, the phone suddenly rang. On the other end was someone claiming to be from the 911 emergency dispatch center, speaking politely: "Ma'am, is someone being attacked in your home right now?"
Fran was confused, and the dispatcher continued slowly: "Please remain calm; your home will soon be surrounded by SWAT. We need your cooperation; come out immediately." She walked to the door, and outside were fully armed SWAT officers, with helicopters buzzing overhead. A few days earlier, there had been a shooting incident involving college students nearby, and the police were particularly tense. Seeing her on the phone, they shouted, "Drop the phone! Come out to the lawn!"
She had no choice but to comply, leaving Hal Finney, who was waiting in the bathroom, unable to move, along with the caregiver and their son. Hal was then carried out to the lawn by the SWAT team, shivering in the wind, with saliva pooling in his throat. Fran feared he would choke to death, and she was on the verge of a breakdown.
This was all a case of "swatting" (maliciously reporting a false emergency to dispatch SWAT). A hacker had called 911 using a spoofed number, falsely claiming, "I just killed someone, and now I'm going to commit suicide," intending to scare the innocent family in Hal Finney's home.
The person behind the call had started extorting Hal Finney's family a month prior, demanding 1,000 Bitcoins—worth over $400,000 at the time. While this amount was not much for Hal Finney, being an early Bitcoin miner, it was evident that most of the money had gone towards expensive ALS medical expenses.
Although this case did not involve direct kidnapping torture, the hacker repeatedly terrorized Hal with threatening calls, painfully tormenting this legendary figure lying on a respirator. Hal Finney's health deteriorated day by day; he had lost the strength to speak normally but still had to muster the remaining emotions and energy to face an extortionist hiding in the shadows. Fran later expressed in an interview, "This took away his last peace."
Until August 28, 2014, Hal Finney passed away.
The Nightmare of Ledger's Co-Founder on a Snowy Night
If Hal Finney's experience is an unforgettable story from the early days of Bitcoin, then the kidnapping case of Ledger co-founder David Balland is one of the most well-known recent kidnappings in the crypto industry.
In the early hours of January 21, 2025, the winter night in the small town of Méreau in central France was eerily quiet. Just after 2 AM, a van quietly parked outside a white-walled villa with a garden. The people inside had no idea that their nightmare had already stepped into their lives, leaving footprints in the snow.
The target was not an ordinary resident but David Balland. Even if he wasn't a household name in the crypto community, he was certainly a well-known figure. He is the co-founder of Ledger, a prominent cold wallet company and an industry benchmark in the cold wallet sector.
David Balland, Ledger co-founder
As a co-founder of the company, David Balland had been fully committed since Ledger's establishment in 2014 and served as the head of the Vierzon factory from 2019 to 2021. In 2019, Ledger established a dedicated factory in the central French town of Vierzon to produce hardware wallets. The company is currently headquartered in Paris, with approximately 700 employees. In 2023, the company successfully raised €100 million (about $104 million), with a valuation reaching €1.3 billion.
David retired from Ledger in 2021 to start two new startups: Le Centre and Ocel. Both companies aim to bring museums and art into the Web3 + VR space.
David had posted a photo of his new home on Twitter
That night, David was at home with his partner, the curtains half-drawn, the flames dancing in the fireplace, and everything seemed normal. But a few minutes later, masked men kicked open the door, and a group of armed individuals pulled the two out of bed and tied them up without a word. A chill swept through the house, mingling with David's two thoughts: whether they could survive this and what the kidnappers wanted.
He was roughly shoved into a car and dragged to an abandoned warehouse several dozen kilometers away. It was as cold as an ice cellar there, and the kidnappers bound him tightly with tape, even using a knife to torture him to force him to reveal information about the ransom, demanding it be converted into cryptocurrency. He was coerced into messaging another Ledger co-founder, with the ransom amount clearly stated: only accepting cryptocurrency, no police involvement, and no delays, or they would face the consequences.
The warehouse where David was held
His partner was not spared either; she was separately taken to a small town south of Paris and confined in the back seat of a van. Cold air seeped through the gaps in the vehicle, and she was bound all over, her hands and feet numb and devoid of feeling, only able to listen to the occasional sounds of passing cars outside, hoping someone would discover her.
This group was very knowledgeable: they contacted Ledger regarding the ransom via WhatsApp, using a phone number registered in Southeast Asia and employing multiple VPNs to cover their tracks. Ledger was hesitant to push back hard and initially transferred a portion of the ransom to buy some time for the police to trace the kidnappers.
For the kidnappers, this was just about money; for the French police, it was a matter of dignity. A total of 230 gendarmes and 91 members of the French Gendarmerie Intervention Group, along with cyber security and intelligence teams, worked tirelessly to lock down license plates, track phones, and conduct a night raid. From the time of the kidnapping to the rescue, the French police took less than 48 hours.
The French police's statement regarding the case
On the afternoon of January 23, in the suburbs of Paris, two suspicious vans were intercepted by the police just as they parked on the roadside. Inside the vehicles were three men and the partner, who was bound in the back seat, her face pale from the cold. When the police pulled her out, she was nearly hypothermic, unable to even scream. Meanwhile, David was also rescued from the warehouse, alive, but in the hostage video, the kidnappers had indeed used a knife to coerce Ledger into paying, even cutting off one of his fingers to send a video to the company's executives, creating a scene so gruesome it sent chills down one's spine.
Ten kidnappers were arrested on the spot: nine men and one woman, aged from their early 20s to over 40, most of whom had prior criminal records, with the mastermind being a 24-year-old Franco-Moroccan. This arrest was just the first step; they faced multiple charges, including "organized violent kidnapping," "armed extortion," and "torture," which in France can lead to life imprisonment.
After being rescued, David was taken to the hospital for treatment; his hand injury would take time to heal, but compared to that lost finger, the more important thing was that he returned alive.
The "E Guardian" Who Drugged His Father
That cup of tea was brought to him by his son.
In May 2021, in Bethesda, Maryland, a typical affluent suburb with dappled shadows from trees and clean streets, any incident could stir the entire neighborhood. That night, Liam handed his father a steaming cup of tea, secretly sprinkling a bit of white powder into it, smiling as he urged his father, "It's good for your health; it's a little pick-me-up."
His father thought little of it and drank it down. Although his son had a drug habit, he was still the child he had raised, the only son with whom he had traded cryptocurrencies and shared meals, quarreled and reconciled. But after drinking that cup of tea, instead of a good night's sleep, he fell into a two-day coma, nearly losing his life.
The powder was not a supplement but a benzodiazepine sedative—similar to prescription sleeping pills, in high doses enough to render someone without a tolerance completely unconscious.
Evidence of the tea Liam gave to his father, source: case evidence files
That night, after laying his father down, Liam quietly took his father's phone, bypassed two-factor authentication, transferred $400,000 worth of Bitcoin from the account to himself, and exchanged most of it for Ethereum.
After doing all this, he left a note: "I'm not a bad person; I just want to help you and help myself. I will ensure you have the best retirement."
This note written by Liam to his father is one of the pieces of evidence in the case, source: case evidence files
He thought his father would wake up soon, but he overlooked the fact that non-addicts have almost zero tolerance for such drugs. Two days later, a friend noticed that the father had been unreachable for several days and, in a panic, reported it to the police. When the police broke down the door, they found him lying on the bedroom floor, weak, severely dehydrated, and with organ functions beginning to fail.
The doctor said that if they had been a few hours later, he would have died.
Liam was born into a middle-class family in Maryland. After his parents divorced, he was the only child. He was good at tennis as a child and started an online consignment clothing business after graduating high school. Later, he became fascinated with cryptocurrency and began acting as a "financial advisor" for his father.
"You are always too emotional and too attached to this token," Liam would often advise his father.
His father gave him $100,000 as capital, and as the account value soared, they cashed out some of their cryptocurrency holdings in 2018, making about $350,000 in after-tax profits. However, Liam's drug use began to deteriorate rapidly; he would pass out every day, moving from his apartment to his family's home, and eventually went missing.
As his son's suspicions grew, so did his obsession with the plummeting price of Bitcoin. At that time, the father was worried about his son's judgment and thus double-locked their investment account.
"Dad, you need to sell it," the father recalled his son telling him. "No, you need to stop using drugs," the father replied.
And then that cup of tea appeared. After moving furniture, they had a meal nearby, and when they returned home, Liam brought out two cups of "special" tea, one for himself and one for his father.
After pleading guilty, Liam underwent drug treatment and rehabilitation, source: The Washington Post
After the police got involved, they initially opened the case as "attempted murder," given that the father nearly lost his life. However, after a deeper investigation, the prosecution found that this resembled a crime committed under the delusion of "good intentions" by an addict—he did not intend to actually kill anyone. The case ultimately concluded with a charge of first-degree assault. Considering that Liam had no prior record, cooperated with treatment, and his family chose to forgive him, the court sentenced him to 125 days in jail, along with mandatory drug rehabilitation, plus 20 years of probation. If there was any further violence, he would immediately go to state prison.
Upon leaving the cell, Liam moved into a rehabilitation group dormitory in Rockville, working odd jobs during the day and attending drug recovery support meetings at night. His father would come to see him, and sometimes they would work on his old Subaru together. "I apologized to my dad, but I know that just saying sorry isn't enough," Liam said. "I want to show him through my actions that I am really becoming that good son again."
Perhaps this father and son will share tea again, but this time, the father will likely smell it first before drinking.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
