Kidnapping and extortion, murder, and serial crimes: five real-life cases in the cryptocurrency world

It's hard for someone to take your real estate at gunpoint, but if you have a string of cryptocurrency that can be transferred at any time and cashed globally, it's a perfect walking ATM for criminals.

According to incomplete statistics of public cases by BlockBeats, there were about 7 "physical" crypto kidnappings, home robberies or violent threats in 2022; by 2023, this number at least doubled to about 15-18; it continued to grow in 2024, with at least 20 cases, and the average amount involved in a single case was higher, with ransoms or losses of more than one million US dollars in several cases; at least 34 cases had occurred in the first half of 2025 (as of June), far exceeding last year and setting a new record high. The vast majority of cases are classic “wrench attacks,” where even if the victim has the most secure cold wallets and cryptographic defenses, they are ultimately vulnerable to a knife, a wrench, or a stun gun.

The term wrench attack comes from a famous XKCD cartoon: When complex cryptographic protection is faced with physical violence, only a wrench is needed to make you hand over your private key

Typical methods of these wrench attacks include: breaking into the house directly, threatening with weapons or tying up and torturing, forcing mnemonics or transferring money; disguising as police, agents, insurance agents, Ubers, etc. Drivers, etc., first trick people into a confined space before taking action; use acquaintances or seduction to ambush, and make appointments to hotels, apartments, and cars to carry out the crime; organized gangs travel across borders to commit crimes, such as South Asian gangs in Southeast Asia, Russian gangs in Thailand and Uganda impersonating military police, etc.

Bali Tragedy: A Deadly Murder in a Holiday Paradise

Speaking of cryptocurrency-related kidnapping cases, most people’s first impression is the Bali Couple Tragedy, a case that has caused a lot of shock in both the currency circle and the tourism circle.

The time was May 1, 2023, and the location was a five-star hotel in Bali, Indonesia. A 22-year-old Chinese couple who came to travel were found to have died accidentally, and their death was tragic.

Based on the testimony of 31 witnesses and forensic examinations conducted by the Indonesian police at the time, the official conclusion was relatively simple and direct: the man first strangled his girlfriend, then stabbed himself with a beer bottle, and then committed suicide. The police said that the two had quarreled over some personal conflicts before Bali, and the man's left hand was injured, so from the police's perspective, this was a typical "murder-suicide."

But there was a detail that made this case explode in the currency circle for a time - there were rumors that the deceased was a person in the currency circle, and the man might have about 200 million yuan worth of cryptocurrency in his hands.

But at the same time, many details of the case were exposed online, such as why the two people checked in at different times, and why the hotel room was registered under the girl's name? The first thing the man did when he arrived at the hotel room was to check the next door and the corridor repeatedly. Was he afraid that someone would sneak in from the secret passage or the window? No fingerprints were found on the beer bottle, as if the professional killer had wiped it off after doing his job neatly. Another thing is that in the leaked photo of the boy, he had a small braid and looked a bit "gangster-like". People in the circle said that this kind of temperament and dress is very common in some gangs in Southeast Asia or Hong Kong and Taiwan.

Many details have given the case a widely circulated version: In this "spinach" base and electronic fraud park in Southeast Asia, people like to use USDT or various cryptocurrencies to transfer money to "launder money". And this boy with a huge amount of money took the money from the "boss" under the guise of "laundering money". Several local Indonesian OTC merchants sold his whereabouts when they helped him exchange USDT for US dollars. The "boss" who found out that the money was lost offered a huge reward to "kill the chicken to scare the monkey". The professional killer followed the clues and found the hotel and took action. The way of taking action was completely consistent with the operation of the gang's revenge. Because the "boss" is not a small figure, there may be some warlords and corrupt officials in Southeast Asia behind him. At the same time, they are worried that if this case is magnified, it will scare away a large number of foreign tourists, so the local government would rather suppress it.

Of course, this is just a version speculated by the public, and it is not necessarily the truth of the case. But because of the mystery and cruelty of the case itself, it has always been very famous in the currency circle. RIP...

According to local Indonesians, this case has hardly caused any splashes in the local area, and the hotel is fine and still doing a booming business. To this day, it is still considered a luxury resort. The sea breeze of Bali has blown through too many news about kidnappings related to cryptocurrencies. It is cold and has nothing to do with the sunshine of the resort.

For example, in early 2023, a message went viral in the crypto circle: a crypto blogger named Yuri Boytsov was targeted. At that time, he rented a sea view villa in Bali. During the day, he taught people to trade cryptocurrencies on Telegram, and at night he drank beer in the sea breeze. As a result, one night, four people suddenly rushed into his house. One of them was still wearing a police uniform, and the other two were white faces with hoods on. Without any nonsense, they first pressed him to the ground, snatched his mobile phone and passport, and then forced him to unlock his wallet and forcibly transferred away $284,000 worth of Bitcoin. Later, the Indonesian police only caught one suspect, and the suspect bit back, saying that Yuri himself was a liar and deserved to be robbed. In the end, the money was not recovered, and the person did not get an explanation. Yuri moved to another country in disgrace.

There is an older case that happened at the end of 2021. An Italian couple living in a villa in Seminyak was broken into by several people at three in the morning. The criminals were all dressed in black, wearing gloves and hoods. They first tied up the male owner, put a knife to his neck, sealed his mouth with tape, and then asked for the password of his mobile phone. If they don't cooperate, they will beat and threaten them in various ways. In the end, the Bitcoin account and six mobile phones were robbed of all their money, which is equivalent to about 374,000 US dollars. Afterwards, the police found that two of the foreign men who committed the crime had previously eaten and held parties at the victim's home. At present, the police have only arrested two of them, and the remaining Polish and Russian men are still wanted.

Father pays for son's debt: kidnapping and theft case

On August 25, 2024, a hot and irritating Sunday afternoon, in an upscale community in Danbury, Connecticut, the lawn was neatly trimmed, and there were freshly cleaned outdoor lounge chairs next to the swimming pool. Most of the people living here are stable and wealthy, and the chance of kidnapping is not common. A policeman may only encounter one in his life.

Sushil is the vice president of Morgan Stanley. Although his annual salary is high, he is not rich enough to shock the world. That day, Sushil and his wife were driving their newly bought Lamborghini to look at houses in the community. But this middle-class couple did not expect that a terrifying nightmare would happen in the next few minutes.

As soon as the car turned around an intersection, a white Honda suddenly hit the rear of Sushil's Lamborghini from behind. Sushil subconsciously stepped on the brakes and was about to get out of the car to see what was going on. A large white truck rushed out from the front and blocked the Lamborghini. Within a few seconds, six men in black clothes and masks rushed out from the front and back cars. There was almost no time for people to react. The car door was torn open and the couple were dragged out. Sushil screamed and struggled desperately, but a baseball bat hit him hard on the head, and blood covered half of his face.

The couple was dragged to the trunk of the truck and tied up tightly with tape, like a mummy, with two wraps around their mouths, unable to move their hands and feet, and breathing only through the gap in their nostrils. The truck turned around and stepped on the accelerator to run away, just like in the movie. But the movie was an act, and the couple's fear and suffocation were real. The metal car shook violently, and the kidnappers hit them with baseball bats from time to time, and each hit was painful.

But what the kidnappers didn't expect was that an off-duty FBI agent happened to witness everything nearby. He immediately followed the truck and reported the license plate number to the local police. Within ten minutes, the patrol car blocked the truck. Seeing that something was wrong, the driver started running all the way, going against the flow, running red lights, and hitting the curbs, sparking everywhere. After chasing for about a mile, the car finally lost control and hit the roadside guardrail. The four kidnappers jumped out of the car and fled under the bridge and into the woods, but were eventually pinned down by the police. The couple who were rescued were covered in wounds, their legs were still taped, and their faces were covered in blood. Strangely, law enforcement found that the suspects, aged between 18 and 26, had rented a car from Miami and drove all the way to Connecticut. The entire journey from Miami to Connecticut is about 2,100 kilometers, and it takes 20 hours to drive straight without stopping. What on earth did this couple have that was worth a group of people flying from Florida to Connecticut to kidnap? Sushil was just an investment bank executive, and although his salary was high, if they really wanted to make money, they could just rob the car directly, why kidnap him? The truth was slowly revealed later. The police looked through the phones of several suspects and watched their chats in the group, only to find that the real target of this group was not the couple, but their son, Veer Chetal, an 18-year-old high school graduate, who even led to a theft of $250 million worth of cryptocurrency.

Chetal's identity is not simple. He studied at Rutgers University in New Jersey during the day, but he was a cryptocurrency thief at night.

Last August, Chetal and several friends he met on the Minecraft game black market formed a "cybercrime group" and used an old but tried-and-tested social engineering routine to impersonate Google and crypto trading platform Gemini customer service to transfer 4,100 bitcoins from an early Bitcoin player in Washington in batches, which was worth $250 million at the market price at the time, and $420 million as of the time of writing.

After getting the money, Chetal and his group lived a lavish life: spending millions of dollars on cars, jewelry, renting luxury houses and attending nightclub parties. They drove Lamborghinis to school, went to nightclubs every few days, changed luxury cars one after another, and had one party after another.

It was at a nightclub in Miami that the young and energetic Chetal had an argument with one of the kidnappers, which eventually turned into a physical conflict. The kidnappers knew that Chetal had a large amount of cryptocurrency, so they flew from Florida to Connecticut, planning to take his parents hostage first and then force Chetal to spit out the remaining money - that afternoon when the Lamborghini was rear-ended.

Behind Chetal are at least dozens of similar small and medium-sized frauds, ranging from tens of thousands of dollars to two or three million dollars. The police searched his home and found $500,000 worth of luxury jewelry and cash and $39 million worth of cryptocurrency.

According to court documents released this week, Chetal has pleaded guilty and agreed to testify in exchange for a reduced sentence, and may face a sentence of about 20 years. Born in India, Chetal came to the United States with his family at the age of four in 2010. He obtained a dependent visa related to his father's foreign worker visa, but he may be deported because of this criminal case. Chetal's father also lost his job at Morgan Stanley because of this incident.

The Lamborghini that once flaunted its status is now parked alone in the parking lot of the police station in Connecticut.

Hal Finney's last blackmail call

If there is anyone in the Bitcoin circle who is recognized as the "white moonlight", Hal Finney must be on the list. Even if he denies that he is the founder of Bitcoin, many people believe that he is Satoshi Nakamoto.

He was the first person to receive a Bitcoin transfer from Satoshi Nakamoto, the first person to understand Bitcoin, and a very early contributor to Bitcoin computing power and code. But such a person, in the last few months of his life, did not pass away quietly. It was the winter of 2014. Hal Finney had been dealing with ALS for five years. He had lost most of his body functions and swallowing had become a dangerous action. His wife Fran had to suction, scrub and change his tubes every day. That morning, she and the nurse were bathing Hal when the phone rang. The person on the other end of the line claimed to be from the 911 emergency dispatch center, and the voice was very polite: "Ma'am, is anyone in your home being attacked right now?"

Fran was confused, and the dispatcher said slowly: "Please calm down, your home will be surrounded by the SWAT commando team soon, and we need your cooperation, come out immediately." She walked to the door, and there were already fully armed SWAT police outside, and helicopters were still buzzing in the air. A few days ago, a college student shooting had just occurred nearby, and the police were particularly nervous. Seeing her holding the phone, they shouted directly: "Drop the phone! Come out to the lawn!"

She had no choice but to do it, leaving Hal Finney, who was still waiting for suction in the bathroom and unable to move, as well as the caregiver and son. Then Hal Finney was carried to the lawn by the SWAT. The wind made him shiver, and his throat was full of saliva. Fran was afraid that he would choke to death, and she was about to collapse.

All this was a "Swatting" (maliciously falsely reporting a case, resulting in the dispatch of SWAT). The hacker called 911 with a fake caller ID, claiming "I just killed someone and now I want to commit suicide", with the goal of getting fully armed SWAT to rush into Hal Finney's home and scare the innocent people in the family.

The person behind the call had started blackmailing Hal Finney's family a month ago, asking for 1,000 bitcoins - more than $400,000 at the time. Although this amount of money was not much for Hal Finney, after all, he was an early Bitcoin calculator, it was clear that most of the money was invested in expensive ALS medical expenses.

Although this case did not suffer direct kidnapping torture, the hacker repeatedly made threatening calls and threatened to expose the painful torture of this legendary figure lying on a ventilator. Hal Finney's health was getting worse day by day. He no longer had the strength to speak normally, but he had to use his remaining emotions and strength to face a blackmailer hiding in the dark. Fran was still distressed when she was interviewed later: "This took away his last peace."

Until August 28, 2014, Hal Finney passed away.

Ledger co-founder's snowy night nightmare

If Hal Finney's experience is a thrilling story that cannot be avoided in the early days of Bitcoin, then the kidnapping of Ledger co-founder David Balland is the most well-known kidnapping case of a crypto industry figure in recent times.

In the early morning of January 21, 2025, the winter night in the small town of Méreau in central France was a little too quiet. Just after 2 a.m., a van quietly stopped outside a white-walled villa with a garden. The people in the house had no idea that their nightmare had already walked in through the snow.

The person being targeted was not an ordinary resident, but David Balland. Even if he is not a household name in the cryptocurrency circle, he is at least a well-known figure. He is the co-founder of Ledger, a well-known cold wallet company in the crypto industry, and one of the industry benchmarks in the cold wallet track.

As the company's co-founder, David Balland has been fully committed to Ledger since its inception in 2014, and served as director of the Vierzon factory from 2019 to 2021. In 2019, Ledger established a dedicated factory in Vierzon, a small town in central France, to produce hardware wallets. The company is currently headquartered in Paris and has a total of approximately 700 employees. The company successfully raised 100 million euros (about 104 million US dollars) in 2023, with a valuation of 1.3 billion euros.

David also retired from Ledger in 2021 and founded two new startups: Le Centre and Ocel. Both companies are committed to bringing museums and art into the field of Web3 + VR.

That night, David was at home with his partner, the curtains were half-drawn, the flames were dancing in the fireplace, and everything looked normal. But a few minutes later, the men in black kicked the door open, and a group of people with guns pulled the two people off the bed and tied them up without explanation. The cold air suddenly poured into the room, mixing with two thoughts in David's mind: one was whether they could get out alive, and the other was what the kidnappers wanted.

He was roughly stuffed into a car and dragged all the way to an abandoned warehouse dozens of kilometers away. It was as cold as an ice cellar there. The kidnappers tied him up tightly with tape and even used a knife to torture him. In order to force him to speak, they converted the ransom into cryptocurrency and sent it to him. He was forced to send a message to another founder of Ledger, and the ransom amount was clearly written: only cryptocurrency is accepted, do not call the police, do not delay, otherwise you will bear the consequences.

His partner was not spared either. She was taken to a small town south of Paris and locked in the back seat of a van. The cold wind poured in through the seams of the van. She was tied up all over, her hands and feet were numb and she had no feeling. She could only listen to the occasional car passing outside, hoping that someone would find her.

This gang is very knowledgeable: the ransom was paid through WhatsApp, the mobile phone number was in Southeast Asia, and VPN was used to go through several routes. Ledger did not dare to delay it, so it could only remit part of it first to buy some time for the police to follow the clues.

For the kidnappers, it was just money; for the French police, it was a battle of dignity. 230 gendarmes, 91 French gendarme special forces, and cyber security and intelligence lines ran one by one, first locking the license plate, then locating the mobile phone, and finally raiding overnight. From kidnapping to releasing the person, the French police took less than 48 hours.

On the afternoon of January 23, in the suburbs of Paris, two suspicious vans were seized by the police as soon as they stopped on the roadside. In the car, there were three men and the partner who was tied to the back seat and was pale with cold. When the police carried the person out, she was almost hypothermic and couldn't even shout. On the other side, David was also rescued from the warehouse. He was alive, but in the hostage video, the kidnappers used knives to force Ledger to pay money. Even one of his fingers was cut off and filmed and sent to the company's senior management. The scene was so bloody that it made people's backs cold.

10 kidnappers were arrested on the spot: 9 men and 1 woman, ranging in age from early 20s to over 40s. Most of them had criminal records. The mastermind was a 24-year-old French-Moroccan. This time, catching people is only the first step. What awaits them are multiple charges such as "organized violent kidnapping", "armed extortion", and "torture and abuse" - in France, the maximum sentence is life imprisonment.

After being rescued, David was sent to the hospital for treatment. The hand injury needs time to recover slowly, but more important than that finger is that he is back alive.

The "E Guard" who knocked out his father

The cup of tea was brought by the son himself.

In May 2021, in Bethesda, Maryland, the United States, a typical middle-class wealthy area with mottled tree shadows and clean streets, any incident can alarm the entire neighborhood. That night, Liam handed his father a cup of hot tea, and quietly sprinkled some white powder in the tea. He smiled and advised his father: "It's good for your health, it's a little refresher."

The father didn't think much and drank it. Although his son has the bad habit of taking drugs, after all, this is his own child, the only son who trades coins together, eats together, quarrels and reconciles. But this cup of tea was not exchanged for a good night's sleep, but two days of coma and almost losing his life.

This powder is not a tonic, but a benzodiazepine sedative - similar to the ingredients of prescription sleeping pills, and high doses are enough to make a person who is not resistant to the drug lose consciousness directly.

That night, after Liam knocked his father down, he quietly picked up his father's mobile phone, skipped the two-step verification, transferred $400,000 in Bitcoin from the account to himself, and exchanged most of it for Ethereum.

After doing all this, he left a note: "I'm not a bad person, I just want to help you and myself. I will give you the best retirement life."

He thought his father would wake up soon, but he ignored the fact that non-addicts have almost zero tolerance to this drug. Two days later, a friend found that the father had been missing for many days and could not get in touch with him, so he panicked and called the police. When the police broke into the room, they found him lying on the bedroom floor, with weak breath, severe dehydration, and organ dysfunction.

The doctor said that if it had been a few hours later, the person would have died.

Liam was born in a well-off family in Maryland. After his parents divorced, he was the only child in the family. He played tennis well when he was a child. After graduating from high school, he founded an online clothing consignment company. Later, he became fascinated with cryptocurrency and began to serve as a "financial advisor" for his father.

"You are always too emotional and too attached to this token." Liam always advised his father like this.

His father gave him $100,000 as principal. As the value of the account soared, the two cashed out part of their cryptocurrency holdings in 2018 and made about $350,000 in after-tax profits. However, Liam's drug abuse began to deteriorate sharply. He would fall into a coma every day, move from the apartment to his family's home, and finally disappear.

As his son’s suspicions grew, so did his obsession with the collapse in bitcoin’s price. But by then, his father was concerned about his son’s judgment, so he put a double lock on their investment accounts.

“Dad, you need to sell it,” the father recalled his son telling him. “No, you have to stop taking drugs,” the father replied.

And so the cup of tea appeared. After moving the furniture, the two had a meal nearby, and when they returned home, Liam brought over two cups of the “specially blended” tea, one for himself and one for his father.

After the police intervened, they initially filed a case of "attempted murder", after all, his father almost died. But after an in-depth investigation, the prosecutor found that this was more like a crime with "benign illusions" under the addict's loss of control - he did not intend to really kill anyone, and the case was eventually closed as a felony first-degree assault. Considering that Liam had no criminal record, actively cooperated with treatment, and his family chose to forgive, the court sentenced him to 125 days in prison, intensive drug rehabilitation, and 20 years of probation. If there is another violent incident, he will go to state prison immediately.

When Liam walked out of the cell, he moved into the Rockville rehabilitation group dormitory, working odd jobs during the day and attending drug rehabilitation meetings at night. His father would come to see him, and the two of them would sometimes work together to repair his old Subaru. "I apologized to my father, but I know that just apologizing with words is useless," Liam said, "I want to use my actions to let him know that I am really turning back into that good son."

Perhaps the father and son will drink tea together again, but this time, the father should smell it before drinking it.