The kidnapping of a cryptocurrency executive whose finger was severed before French special forces rescued him has thrown a spotlight on a growing and violent threat facing those who profit from digital currencies — as physical attacks on crypto figures surge to record levels and the UK emerges as one of the worst affected countries in the world.
David Balland, co-founder of hardware wallet company Ledger, was abducted from his home in the quiet French town of Vierzon by a criminal gang demanding a $10 million ransom. His wife was taken separately. Police launched a frantic manhunt and special forces eventually rescued both, but not before the kidnappers had cut off one of Balland’s fingers.
The case is the most high-profile example of what have become known as “wrench attacks” — a term derived from a 2014 internet cartoon depicting criminals threatening to batter someone with a wrench to obtain their computer password. The concept has since moved from darkly comic internet meme to grim reality. A report from crypto security firm Certik found there had been 34 physical attacks on industry figures in the first three months of 2026 alone — a 41 per cent increase on the same period in 2025 — resulting in publicly reported cryptocurrency thefts of more than $101 million. Last year saw 81 recorded attacks resulting in losses of $52 million. Security business Gart, which has documented 340 wrench attacks worldwide over the past decade, says the vast majority have occurred in the last three years. It has also recorded at least 26 fatal attacks.
The methods are becoming increasingly brutal. In December, two Ukrainian men were arrested in Vienna after a man was lured to an underground garage, had his teeth knocked out, choked to death on his own blood after surrendering his cryptocurrency encryption keys, and was found burned in the boot of his own Mercedes. In New York last March, two men were arrested after allegedly drugging a man and applying electric shocks to force him to surrender his Bitcoin password.
France has been worst hit, with an attack occurring every 2.5 days this year. Certik describes it as the “global epicentre,” attributing the concentration to a cluster of major crypto businesses, a culture of wealth-flaunting among influencers on social media, and a series of data breaches that exposed the personal details of crypto holders to criminals. In February, the French chief executive of Binance had his home invaded. In April, a mother and her 11-year-old child were kidnapped in Burgundy as attackers attempted to extort $400,000 from the woman’s crypto entrepreneur husband.
The UK ranks third worst globally, accounting for 24 recorded incidents. Last week, Hertfordshire Police announced that four men had been sentenced to between three and six years after kidnapping and falsely imprisoning a 36-year-old London man. The victim was followed home after a night out, woke up beaten with no memory of events, and found £10,000 had been drained from his accounts. The investigation was triggered after Coinbase detected unusual activity on his funds.
Ari Redbord, head of global policy at blockchain intelligence company TRM Labs, said the nature of the threat was shifting from opportunistic to organised. Prosecutors were finding that raids were being arranged by structured criminal networks “conducting pre-operational surveillance and using encrypted platforms to recruit foot soldiers while insulating organisers from direct exposure.”
The chilling effect on the industry is tangible. Coinbase spent $8.7 million on security for its chief executive Brian Armstrong in 2025, up from $6.2 million the previous year. Crypto influencers are increasingly reluctant to discuss their wealth publicly. “It’s advertising me as a risk,” said one entrepreneur. Many believe the true scale of the problem is far larger than official figures suggest. “Incidents get logged as standard robberies or burglaries — the crypto connection disappears from the record,” said Redbord.
