Author: Jaleel Jialiu, BlockBeats

It's hard for someone to rob you of your real estate at gunpoint, but if you have a string of cryptocurrency that can be transferred at any time and cashed globally, it's a perfect walking ATM for criminals.

According to incomplete statistics of public cases by BlockBeats, there were about 7 "physical" crypto kidnappings, home robberies, or violent threats in 2022; by 2023, this number at least doubled to about 15-18; it continued to grow in 2024, with at least 20 cases, and the average amount involved in a single case was higher, with several cases of ransom or losses exceeding one million US dollars; at least 34 cases had occurred in the first half of 2025 (as of June), far exceeding last year and setting a new record. The vast majority of cases are typical "wrench attacks". Even if the victim has the safest cold wallet and cryptographic defenses, it will not be able to stop a knife, a wrench, or a stun gun in the end.

The term “wrench attack” comes from a famous XKCD cartoon: When complex cryptographic protection is faced with physical violence, all it takes is a wrench to make you hand over your private key.

Typical methods of these wrench attacks include: breaking into homes directly, threatening with weapons or tying up and torturing, forcing people to hand over mnemonics or transfer money; disguising as police officers, agents, insurance agents, Uber drivers, etc., to trick people into entering a confined space before attacking; using acquaintances or seduction to ambush, and carrying out the attacks in hotels, apartments, or cars; organized gangs committing crimes across borders, such as South Asian gangs in Southeast Asia, and Russian gangs impersonating military police in Thailand and Uganda.

Bali tragedy: a deadly murder in a holiday paradise

When it comes to cryptocurrency-related kidnapping cases, most people’s first impression is the Bali couple tragedy, a case that caused quite a stir in both the cryptocurrency and tourism circles.

The time was May 1, 2023, and the location was a five-star hotel in Bali, Indonesia. A 22-year-old Chinese couple who were traveling there were found dead in a tragic way.

Based on the testimony of 31 witnesses and forensic examinations conducted by the Indonesian police at the time, the official conclusion was relatively simple and direct: the man first strangled his girlfriend, then stabbed himself with a beer bottle until he was bloody, and then committed suicide. The police said that the two had quarreled over some personal conflicts before they arrived in Bali, and the man's left hand was injured, so from the police's perspective, this was a typical "murder-suicide."

But there is a detail in this that caused this case to cause a stir in the cryptocurrency circle for a while - there are rumors that the deceased is a person in the cryptocurrency circle, and the man may have cryptocurrencies worth about 200 million yuan in his hands.

The crypto community discussed

 A cryptocurrency trader with the WeChat name "nnn" once spoke out about this matter, saying that the male deceased was his friend and that the two had chatted and communicated half a month ago.

Before the official case was determined to be a "murder-suicide," most people in the cryptocurrency circle speculated that someone had their eyes on the money and wanted to force him to hand over the wallet key, so the suspect lynched the two people and tried to get the password, but in the end the people were gone and the money was nowhere to be found.

But at the same time, many details of the case were exposed online, such as why the two people checked in at different times, and why the hotel room was registered under the girl's name? The first thing the man did when he arrived at the hotel room was to repeatedly check the next door and the corridor. Was he afraid that someone would sneak in from the secret passage or the window? No fingerprints were found on the beer bottle, as if a professional killer had wiped it off after doing his job neatly. Another thing is that in the leaked photo of the boy, he had a small braid, and he looked a bit "gangster-like". People in the circle said that this kind of temperament and dress is very common in some gangs in Southeast Asia or Hong Kong and Taiwan.

Many details have given the case a widely circulated version: In this "gambling" base and electronic fraud park in Southeast Asia, people like to use USDT or various cryptocurrencies to transfer money to "launder money". And this boy with a huge amount of money took the money from the "boss" under the guise of "laundering money". Several local Indonesian OTC merchants sold his whereabouts when they helped him exchange USDT for US dollars. The "boss" who found out that the money was lost offered a huge reward to "kill the chicken to scare the monkey". The professional killer followed the clues and found the hotel and took action. The way of taking action was completely in line with the operation of the gang's revenge. Because the "boss" is not a small figure, there may be some warlords and corrupt officials in Southeast Asia behind him. At the same time, they are worried that if this case is magnified, it will scare away a large number of foreign tourists, so the local government would rather suppress it.

Of course, this is just a rumor, not necessarily the truth of the case. But because of the mystery and cruelty of the case, it has always been very famous in the cryptocurrency circle. RIP…

According to local Indonesians, the case barely made a splash in the local area, and the hotel is doing fine and still doing a booming business. To this day, it is still considered a luxury resort. The sea breeze of Bali has blown through too many news reports of encryption-related kidnappings, and it is cold and has nothing to do with the sunshine of the resort.

For example, in early 2023, a piece of news went viral in the crypto circle: a crypto blogger named Yuri Boytsov was targeted. At that time, he rented a sea view villa in Bali. During the day, he taught people to trade cryptocurrencies on Telegram, and at night he drank beer in the sea breeze. As a result, one night, four people suddenly rushed into his house. One of them was still wearing a police uniform, and the other two were white faces, covered with hoods. Without any nonsense, they first pressed the man to the ground, snatched his mobile phone and passport, and then forced him to unlock his wallet and forcibly transferred away $284,000 worth of Bitcoin. Later, the Indonesian police only caught one suspect, and the suspect bit back, saying that Yuri himself was a liar and deserved to be robbed. In the end, the money was not recovered, and the person did not get an explanation. Yuri himself moved to another country in disgrace.

There is an older case that happened at the end of 2021. An Italian couple living in a villa in Seminyak was broken into by several people at three in the morning. The criminals were dressed in black, wearing gloves and hoods. They tied up the male owner, put a knife to his neck, sealed his mouth with tape, and then forced him to ask for his mobile phone password. If he didn't cooperate, they would beat and threaten him in different ways. In the end, the Bitcoin account and six mobile phones were robbed, which was equivalent to about 374,000 US dollars. Afterwards, the police found that two of the foreign men who committed the crime had previously eaten and held parties at the victim's home. At present, the police have only arrested two of them, and the remaining Polish and Russian men are still wanted.

The son's debt is paid by the father: a case of kidnapping and theft

On August 25, 2024, a hot and irritating Sunday afternoon, in an upscale community in Danbury, Connecticut, the lawns were neatly trimmed and freshly cleaned outdoor lounge chairs were placed by the swimming pool. Most of the people living here are stable and wealthy, and the chances of kidnapping are not common. A police officer may only encounter one in his lifetime.

Sushil is the vice president of Morgan Stanley. Although his annual salary is high, he is not so rich that it is shocking. That day, Sushil and his wife were driving their newly bought Lamborghini to look at houses in the community. But this middle-class couple did not expect that a terrifying nightmare would happen in the next few minutes.

As the car turned an intersection, a white Honda suddenly rammed the rear of Sushil's Lamborghini from behind. Sushil subconsciously stepped on the brakes and was about to get out of the car to see what was going on, when a large white truck rushed out from the front and blocked the Lamborghini. Within a few seconds, six men in black clothes and masks rushed out from the front and back cars. There was almost no time for people to react. The car door was torn open and the couple was dragged out. Sushil screamed and struggled desperately, but a baseball bat hit him on the head, and blood covered half of his face.

The couple was dragged to the trunk of a large truck and tied up tightly with tape, like a mummy, with two wraps around their mouths, unable to move their hands and feet, and breathing only through the small gap in their nostrils. The truck turned around and stepped on the accelerator to drive away, just like in the movie. But the movie was acted, and the fear and suffocation of the couple were real. The iron car shook violently, and the kidnappers hit them with baseball bats from time to time, and each hit was painful.

But what the kidnappers didn't expect was that an off-duty FBI agent happened to be nearby and witnessed everything. He immediately followed the truck and reported the license plate number to the local police. Within ten minutes, the patrol car blocked the truck. The driver saw that something was wrong and started running all the way, driving against the flow, running red lights, and scratching the curbs, sparking everywhere. After chasing for about a mile, the car finally lost control and hit the roadside guardrail. The four kidnappers jumped out of the car and fled under the bridge and into the woods, but were eventually pinned down by the police.

The couple was rescued with wounds all over their bodies, their legs were still tied with tape, and their faces were covered with blood. Strangely, the law enforcement department found that the suspects, aged between 18 and 26, rented a car from Miami and drove to Connecticut. The entire journey from Miami to Connecticut is about 2,100 kilometers, and it takes 20 hours even if you drive straight without stopping. What on earth did this couple have that was worth a group of people flying from Florida to Connecticut to kidnap? Sushil is just an investment bank executive. Although his salary is high, if they really want money, they can just rob the car directly. Why kidnap him?

The truth was only slowly revealed later. After the police looked through the suspects’ phones and watched their group chats, they discovered that the real target of the gang was not the couple, but their son, Veer Chetal, an 18-year-old high school graduate, and even led to a theft of $250 million worth of cryptocurrency.

 Veer Chetal, photo provided by the U.S. Marshals Service in March 2025

Chetal’s identity is not simple. He studies at Rutgers University in New Jersey during the day, but is a cryptocurrency thief at night.

Last August, Chetal and several friends he met on the Minecraft game black market formed a "cybercrime group" and used an old but tried-and-true social engineering routine to impersonate Google and crypto trading platform Gemini customer service to transfer 4,100 bitcoins from an early Bitcoin player in Washington in batches. The bitcoins were worth $250 million at the market price at the time, and were worth $420 million as of the time of writing.

After getting the money, Chetal and his gang lived a lavish life: they spent millions of dollars on cars, jewelry, rented luxury houses and attended nightclub parties. They drove Lamborghinis to school, went to nightclubs every few days, changed luxury cars one after another, and had one party after another.

It was at a Miami nightclub that the young and energetic Chetal had an argument with one of the kidnappers, which eventually turned into a physical fight. The kidnappers learned that Chetal had a large amount of cryptocurrency, so they flew from Florida to Connecticut, planning to take his parents hostage and then force Chetal to hand over the remaining money - that afternoon when the Lamborghini was rear-ended.

Chetal was behind at least dozens of similar small and medium-sized scams, ranging from tens of thousands of dollars to two to three million dollars. The police seized $500,000 worth of luxury jewelry and cash and $39 million in cryptocurrencies in his home.

According to court documents released this week, Chetal has pleaded guilty and agreed to testify in exchange for a reduced sentence, and could face a prison sentence of around 20 years. Born in India, Chetal came to the United States with his family in 2010 when he was four years old. He obtained a dependent visa because of his father's foreign worker visa, but he could be deported because of this criminal case. Chetal's father also lost his job at Morgan Stanley because of this incident.

The Lamborghini that once showed off one's status is now parked alone in the parking lot of a police station in Connecticut.

Hal Finney's final ransom call

If there is anyone in the Bitcoin circle who is recognized as the "white moonlight", Hal Finney must be on the list. Even though he denies that he is the founder of Bitcoin, many people believe that he is Satoshi Nakamoto.

He was the first person to receive Satoshi Nakamoto’s Bitcoin transfer, the first person to understand Bitcoin, and a very early contributor to Bitcoin computing power and code. But such a person, in the last few months of his life, did not pass away peacefully.

 Hal Finney and his wife Fran

It was the winter of 2014. Hal Finney had been dealing with ALS for five years. He had lost most of his body functions, and swallowing had become a dangerous action. His wife Fran had to suction, scrub, and change his tubes every day. That morning, she and the nurse were bathing Hal when the phone rang. The person on the other end of the phone claimed to be from the 911 emergency dispatch center, and the voice was very polite: "Ma'am, is anyone in your home being attacked right now?"

Fran was confused, and the dispatcher said slowly, "Please calm down. Your house will be surrounded by SWAT commandos soon. We need your cooperation and come out immediately." She walked to the door. There were already fully armed SWAT outside, and helicopters were still buzzing in the sky. A few days ago, a college student shooting happened nearby. The police were particularly nervous. When they saw her holding the phone, they yelled, "Drop the phone! Come out to the lawn!"

She had no choice but to do so, leaving Hal Finney, the nurse, and her son, who were still waiting in the bathroom for suction and unable to move. Hal Finney was then carried to the lawn by the special police. He was shivering in the wind, and his throat was full of saliva. Fran was afraid that he would choke to death, and she was about to collapse.

All of this was a "swatting" (maliciously falsely reporting a crime, resulting in the dispatch of SWAT). The hacker used a fake caller ID to call 911, falsely claiming "I just killed someone and now I want to commit suicide", in order to get the fully armed SWAT police to rush into Hal Finney's home and scare the innocent people in the family.

The person behind the call had started blackmailing Hal Finney's family a month ago, asking for 1,000 bitcoins, which was more than $400,000 at the time. Although this amount of money was not much for Hal Finney, after all, he was an early Bitcoin calculator, but it was clear that most of the money was invested in the expensive ALS medical expenses.

Although this case did not involve direct kidnapping, the hackers repeatedly made threatening calls and threatened to expose the legendary figure lying on the ventilator. Hal Finney's health was getting worse day by day. He no longer had the strength to speak normally, but he had to use his remaining emotions and strength to face a blackmailer hiding in the dark. Fran was still distressed when she was interviewed later: "This took away his last peace."

Until August 28, 2014, when Hal Finney passed away.

Ledger Lianchuang’s Snow Night Nightmare

If Hal Finney’s experience is a thrilling story that cannot be avoided in the early days of Bitcoin, then the kidnapping of Ledger co-founder David Balland is the most well-known kidnapping case of a crypto industry figure in recent times.

In the early morning of January 21, 2025, the winter night in the small town of Méreau in central France was a little too quiet. Just after two in the morning, a van quietly stopped outside a white-walled villa with a garden. The people in the house had no idea that their nightmare had already walked in on the snow.

The person being targeted is not an ordinary resident, but David Balland. Even if he is not a household name in the cryptocurrency circle, he is at least a well-known figure. He is the co-founder of Ledger, a well-known cold wallet company in the crypto industry, and one of the industry benchmarks in the cold wallet track.

 David Balland, Co-founder, Ledger

As the company's co-founder, David Balland has been fully committed to Ledger since its founding in 2014, and served as the director of the Vierzon factory from 2019 to 2021. In 2019, Ledger established a dedicated factory in Vierzon, a small town in central France, to produce hardware wallets. The company is currently headquartered in Paris and has a total of about 700 employees. The company successfully raised 100 million euros (about 104 million US dollars) in 2023, with a valuation of up to 1.3 billion euros.

David also retired from Ledger in 2021 and founded two new startups: Le Centre and Ocel. Both companies are committed to bringing museums and art into the Web3 + VR field.

 David posted a photo of his new house on Twitter

That night, David was at home with his partner, the curtains were half drawn, the fire was dancing in the fireplace, everything looked normal. But a few minutes later, men in black kicked the door open, a group of people with guns, dragged the two people off the bed, and tied them up without explanation. The cold air suddenly poured into the house, mixing two thoughts in David's mind: one was whether they could get out alive, and the other was what the kidnappers wanted.

He was roughly stuffed into a car and dragged all the way to an abandoned warehouse dozens of kilometers away. It was as cold as an ice cellar there. The kidnappers tied him up tightly with tape and even used a knife to torture him. In order to force him to speak, they converted the ransom into cryptocurrency and sent it to him. He was forced to send a message to another founder of Ledger, and the ransom amount was clearly written: only cryptocurrency is accepted, do not call the police, do not delay, otherwise you will bear the consequences.

 The warehouse where David was imprisoned

His partner was not spared either, and was taken alone to a small town south of Paris and locked in the back seat of a van. The cold wind poured in through the gaps in the van, and she was tied up all over, her hands and feet numb and unconscious, and she could only listen to the occasional car passing by outside, hoping that someone would find her.

This group of people are very knowledgeable: they used WhatsApp to contact for the ransom, their mobile phone numbers were in Southeast Asia, and they used VPN to go through several detours. Ledger didn't dare to drag it out, so it could only transfer a part of the money first to buy some time for the police to follow the clues.

For the kidnappers, it was just money; for the French police, it was a battle of dignity. 230 gendarmes, 91 French gendarmerie special forces, and cyber security and intelligence lines ran one by one, first locking the license plate, then locating the phone, and finally raiding overnight. From kidnapping to releasing the person, the French police took less than 48 hours.

 French police speak out on the case

On the afternoon of January 23, in the suburbs of Paris, two suspicious vans were seized by the police as soon as they stopped on the roadside. In the van, there were three men and the partner who was tied to the back seat and was pale with cold. When the police carried her out, she was almost hypothermic and couldn't even shout. On the other hand, David was also rescued from the warehouse and was alive, but in the hostage video, the kidnappers used a knife to force Ledger to pay money. He even cut off one of his fingers and filmed a video to send to the company's senior management. The scene was so bloody that it made people's backs cold.

Ten kidnappers were arrested on the spot: nine men and one woman, ranging in age from early 20s to over 40s, most of whom had criminal records, and the mastermind was a 24-year-old French-Moroccan. Catching the kidnappers was only the first step, as they were charged with "organized violent kidnapping," "armed extortion," and "torture and abuse" - charges that could carry a life sentence in France.

After being rescued, David was sent to the hospital for treatment. His hand injury will take time to heal, but what is more important than that finger is that he comes back alive.

The "E-Guard" who stunned his father

That cup of tea was brought to me by my son himself.

In May 2021, in Bethesda, Maryland, USA, a typical middle-class wealthy area with mottled tree shadows and clean streets, any incident can alarm the entire neighborhood. That night, Liam handed his father a cup of hot tea, and secretly sprinkled some white powder in the tea. He smiled and advised his father: "It's good for your health, it's a little refresher."

The father drank it without thinking too much. Although his son had a bad habit of taking drugs, he was the child he had raised after all, the only son with whom he had traded cryptocurrencies, eaten together, quarreled and reconciled. But after drinking this cup of tea, he did not get a good night's sleep, but two days of coma and almost lost his life.

The powder was not a tonic, but a benzodiazepine sedative—similar to the ingredients in prescription sleeping pills, and high doses were enough to render a non-drug-tolerant person unconscious.

 Liam handed his father tea evidence, source: case evidence file

That night, after Liam knocked his father down, he quietly picked up his father's phone, skipped the two-step verification, transferred $400,000 worth of Bitcoin in the account to himself, and exchanged most of it for Ethereum.

After doing all this, he left a note: "I'm not a bad person. I just want to help you and myself. I will give you the best retirement life."

 This note Liam wrote to his father is one of the evidence in the case. Source: Case evidence file

He thought his father would wake up soon, but he ignored the fact that non-addicts have almost zero tolerance to the drug. Two days later, a friend found that his father had been missing for many days and could not be contacted, so he panicked and called the police. When the police broke into the room, they found him lying on the bedroom floor, with a weak breath, severe dehydration, and organ dysfunction.

The doctor said that if it had been a few hours later, the person would have died.

Liam was born in a well-off family in Maryland. After his parents divorced, he was the only child in the family. He played tennis well when he was young. After graduating from high school, he founded an online clothing consignment company. Later, he became fascinated by cryptocurrency and began to serve as a "financial advisor" for his father.

"You are always too emotional and too attached to this token." Liam always advises his father like this.

His father gave him $100,000 as capital, and as the account value soared, the two cashed out part of their cryptocurrency holdings in 2018 and made about $350,000 in after-tax profits. However, Liam's drug use began to deteriorate sharply, and he would black out every day, move from the apartment to his family's home, and finally disappear.

As his son’s suspicions grew, so did his obsession with the price of Bitcoin plummeting. But by then, his father was concerned about his son’s judgment and put a double lock on their investment accounts.

"Dad, you need to sell it," the father recalled his son telling him. "No, you have to stop doing drugs," the father responded.

So the cup of tea appeared. After moving the furniture, the two had a meal nearby, and when they returned home, Liam brought the two cups of "specially blended" tea, one for himself and one for his father.

 Liam received drug treatment and rehabilitation after pleading guilty. Photo courtesy of The Washington Post

After the police intervened, they initially filed a case of "attempted murder" because his father almost died. However, after further investigation, the prosecutors found that this was more like a crime with "good intentions" committed by an addict who lost control - he did not intend to really kill anyone, and the case was eventually closed as a felony first-degree assault. Considering that Liam had no criminal record, actively cooperated with treatment, and his family chose to forgive, the court sentenced him to 125 days in prison, intensive drug rehabilitation, and 20 years of probation. If there is another violent incident, he will be sent to state prison immediately.

When he was released from prison, Liam moved into a Rockville rehabilitation group dormitory, working odd jobs during the day and attending drug rehabilitation meetings at night. His father would come to see him, and the two would sometimes work together to repair his old Subaru. "I apologized to my father, but I know that just apologizing with words is useless," Liam said. "I want to let him know with my actions that I am really becoming that good son again."

Perhaps the father and son will drink tea together again, but this time, the father will probably smell it first before drinking it.