Severed Fingers and Wrench Attacks: A New Era in Crypto Crime

Speaker 1 The attack happened early on a Tuesday morning in Paris.

Speaker 2 It's maybe 8:30 in the morning. You know, people are taking their kids to school or daycare.
Businesses are opening up. People are having their coffee.

Speaker 1 That's our colleague, Sam Schechner.

Speaker 2 A white delivery van pulls up, and three men dressed in black masks jump out and grab a 34-year-old woman while she's walking with her husband and her two-year-old toddler.

Speaker 1 Onlookers captured the attack on video.

Speaker 2 They pepper spray

Speaker 2 the family and try to drag her into that truck and she screams and the husband throws himself in front of her and grabs onto her for dear life and won't let go and they're trying to pull her away you know she's screaming help help help

Speaker 2 and you know let go of me let go of me damn it

Speaker 2 eventually more people start coming and a guy who runs a bike shop right nearby runs out of the building holding a fire extinguisher and he kind of runs at the attackers and they just hopped in the back of that white van and and sped off while the bike shop owner just sort of threw the fire extinguisher after them, just barely missing the back of the van as it sped around the corner.

Speaker 1 The assailants fled the scene, leaving the woman, her bloodied husband, and her toddler behind.

Speaker 1 Why did this happen?

Speaker 2 Well, this 34-year-old woman, her father,

Speaker 2 is the CEO of a company called Paymium, which is a cryptocurrency exchange based in France.

Speaker 2 And investigators believe that the kidnappers were attempting to kidnap her in order to get him to pay a large ransom in cryptocurrency.

Speaker 1 Okay. So this was an abduction attempt with the idea of extorting the father.

Speaker 2 This was an old school abduction extortion with the new school twist that what they wanted to be paid in was crypto.

Speaker 1 This trend of using violence in the physical world to access someone's online wealth has a name. It's called a runch attack.

Speaker 1 And runch attacks on people who own millions in crypto have been growing across the globe. Another suspect was arrested in the Bitcoin kidnapping and torture case in Manhattan.

Speaker 1 Three teens accused of kidnapping and robbing a man out of millions of dollars in cryptocurrency. It comes after a series of kidnappings in Europe targeting crypto magnates.

Speaker 1 Welcome to The Journal, our show about money, business, and power. I'm Annie Minoff.
It's Friday, June 20th.

Speaker 1 Coming up on the show, a new violent era of crypto crime.

Speaker 3 This episode is presented by SAP. A bad storm hitting your warehouse.
Incomplete customs forms. A short supply of those little plastic twist ties.

Speaker 3 These could all deal a crushing setback to your business, but they don't have to. The AI-powered capabilities of SAP will help you navigate uncertainty.

Speaker 3 You can pivot to new suppliers, automate paperwork, and source the twist ties you need so your business can stay unstoppable. Learn more at sap.com slash uncertainty.

Speaker 2 This episode is brought to you by PayPal. Now through December 8th, you can get 20% cash back when you pay in four with PayPal.
No fees, no interest.

Speaker 2 This limited-time offer is perfect for the Black Friday and Cyber Monday deals you've been eyeing.

Speaker 2 Whether it's the must-have book or a tiered cheese board, PayPal helps you make the most of your money. Save the offer in the app now.
Expires 1208, cpaypal.com/slash promo terms. Subject to approval.

Speaker 2 Learn more at PayPal.com/slash payin' for PayPal Inc., NMLS 910457.

Speaker 1 The full term for a wrench attack is a $5 wrench attack, and it stems from a comic strip on XKCD, an online web comic that often covers science and tech.

Speaker 1 In this two-panel comic, titled Security, two stick figures are trying to hack into someone's crypto account. The first panel depicts, quote, a crypto nerd's imagination.

Speaker 2 One of the stick figures says, his laptop's encrypted. Let's build a million-dollar cluster to crack it.
And the other stick figure says, no good. It's 4096-bit RSA.

Speaker 2 And then the first one says, blast, our evil plan is foiled.

Speaker 1 The other panel is titled, What Would Actually Happen?

Speaker 2 One stick figure says to the other, his laptop's encrypted. Drug him and hit him with this $5 wrench until he tells us the password.
And everyone takes the wrench and says, got it.

Speaker 1 So it's kind of the brute force approach.

Speaker 2 Yeah, literally brute force.

Speaker 2 Not the crypto brute force approach, but literal brute force.

Speaker 1 The crypto thefts that you usually hear about happen online, with hackers who break into exchanges or scammers who phish people through text messages.

Speaker 1 But there's always been the more straightforward approach, violence. And this year, wrench attacks have been on the rise.

Speaker 1 That's for a few reasons. One, crypto is more valuable and more worth stealing than ever before.
Prices are way up, especially for Bitcoin, which is currently valued at over $100,000.

Speaker 1 But another reason is that it's just harder to steal crypto online these days.

Speaker 1 The crypto rich have gotten savvier about where and how they store their keys, the string of numbers and letters that gives someone access to their crypto wallet.

Speaker 2 Increasingly, what crypto enthusiasts do is something called self-custody, which means that you keep it offline, air-gapped, away from the internet. There are devices that help you do this.

Speaker 2 I mean, the old school way would be to write your key down in a notebook, but, you know, the keys are very long.

Speaker 2 So instead, you usually have a device that you keep the keys offline, in your pocket, or in a safe somewhere.

Speaker 1 That might insulate you from an online attack, but it won't help you if, for instance, someone breaks into your home and threatens you with violence if you don't give up your key.

Speaker 1 Who's being targeted? in these attacks?

Speaker 2 The main through line we see is people who are well known for having a lot of crypto.

Speaker 1 People like crypto influencers.

Speaker 2 I've made over a million dollars from crypto.

Speaker 5 Here's my exact trade. I made $2 million in 10 months with Bitcoin.

Speaker 2 I'm sitting in this bed, in this studio apartment, and I just became a millionaire.

Speaker 2 Talking about your crypto wealth online, being an online influencer, a crypto influencer, is becoming a more dangerous game these days.

Speaker 1 A French influencer named Killian Desnos learned just how dangerous a few years ago.

Speaker 2 Killian Desnos, who is known online as Tufer, he was a YouTube and Twitch streamer.

Speaker 2 Tufer was well known for his crypto holdings.

Speaker 1 In August of 2023, two people kidnapped Desnos' father from his house in France. One of them was dressed as an Amazon delivery driver.

Speaker 1 They sent Desnos a ransom video showing his father bound with a gun to his head. Desnos paid the ransom, and his father was freed.

Speaker 1 And this is because Tuffer was a little bit braggy online about his crypto wealth? Is that...

Speaker 2 Well, you know, that certainly seems to be... be the case.
And indeed, Tuffer, you know, said that he sort of blamed himself.

Speaker 2 You know, he said on X that maybe, maybe he should have been more secretive.

Speaker 2 And after the recent kidnapping attempt in Paris, he wrote again on X that these kidnappings remind him of what happened to his family and that he actually got out of crypto.

Speaker 1 At least two people were later arrested and faced preliminary charges in the case.

Speaker 1 Another group that's been targeted in wrench attacks are crypto entrepreneurs. and executives known to have crypto wealth.
And the pool of victims comes from around the world.

Speaker 1 Last July, an Australian crypto billionaire narrowly escaped abduction in Estonia. In March, a Houston crypto influencer's husband got into a shootout with home invaders demanding her laptop.

Speaker 1 And just last month, there was a big case in New York City.

Speaker 6 Police made a second arrest in an alleged cryptocurrency kidnapping scheme in New York City.

Speaker 1 Two men allegedly tortured an Italian man for weeks in an apartment to try to get it as crypto. And then there was a case earlier this year that shocked the crypto world.

Speaker 1 Before it ended, somebody would be missing a finger.

Speaker 1 That's next.

Speaker 2 As a small business owner, you know that change is the name of the game. Operational costs, labor markets, tariffs.
Wouldn't it be nice if something stayed the same?

Speaker 2 How about your business internet rate? Get reliable, secure 5G business internet from T-Mobile for business for $50 a month with a five-year price guarantee when paired with a voice line.

Speaker 2 That's the stability you need from a partner you can depend on. Switch now at t-mobile.com/slash bi

Speaker 2 plus taxes and fees guarantee exclusions like taxes and fees applies to the exclusions and details at t-mobile.com.

Speaker 4 This episode is brought to you by Zoom.

Speaker 2 Work isn't just meetings.

Speaker 4 It's calls, chats, docs, emails, calendar invites, events, and more. And Zoom brings it all together on one platform.
Everything flows together so you can finally focus on what matters.

Speaker 4 With Zoom, ideas happen faster, projects move forward, and your workday finally works for you. Zoom is more than meetings, it's a unified platform powering how people get work done.

Speaker 4 Learn more at zoom.com slash podcast and Zoom ahead.

Speaker 1 It happened sometime before sunrise in central France.

Speaker 2 David Belon and his partner were kidnapped brutally at gunpoint. They were separated, put in different vehicles, and driven off.

Speaker 1 David Belon is one of France's crypto elite. He helped found a crypto company called Ledger.

Speaker 1 Within hours of the abduction, other Ledger co-founders had heard from one of the kidnappers. He wanted a ransom of 10 million euros to be paid in a cryptocurrency called Tether.

Speaker 1 And his messages made it clear that he wasn't messing around.

Speaker 2 Very quickly, they escalated to the point of showing a video of Balon as his finger was cut off.

Speaker 1 Oh my gosh.

Speaker 2 He had his pinky finger severed by one of the assailants. And, you know, others showed him in emotional distress, what looked like a gun to his head.

Speaker 1 Valon's friends, his co-founders, went to the police, and together they'd embark on a multi-pronged strategy.

Speaker 1 Part one was to start paying some of the ransom to buy police time to find Valon and his partner. And part two involved trying to get those ransom payments back.

Speaker 2 They had connections to kind of get directly to Tether and to some of the exchanges that were involved so that they could get the cryptocurrency back as soon as the hostages were freed.

Speaker 1 The idea was that as soon as Belon and his partner were safe, the co-founders contacts would pull back the ransom payments and recover the money.

Speaker 2 And that meant that they basically had to stay on a vigil because they didn't know when they would be freed. And so you had some of the people on this team to claw back the ransom who were up 24-7.

Speaker 2 And there was always somebody on duty waiting for the call. And they were following in real time as police raided one house.
Nope, he's not there. Another house.
Nope, he's not there.

Speaker 2 And then finally,

Speaker 1 police raided a farmhouse in the French countryside, and they found Balon.

Speaker 2 David is freed. And they're almost ready to push the button, basically, and make the call to claw back the crypto.
And then it turns out that the partner is not there.

Speaker 1 They'd have to wait until Balon's partner was found to claw back the ransom. But they didn't wait long.

Speaker 1 They made another ransom payment, and she was discovered the following day in a van at a roadstop an hour and a half north of the farmhouse where police had found Balon.

Speaker 2 She was shaken but okay. And so that story had a happy ending, but, you know, with the caveat that it was a pretty harrowing experience for both of them.
Of course.

Speaker 2 David was one finger short and he actually later later posted to social media on his profile that he, you know, it was like the, he wrote like kidnapping championship 2025, fingers nine out of ten.

Speaker 1 In total, Balan's friends clawed back most of the 3 million euros in crypto that they'd sent as a ransom.

Speaker 1 It's interesting that the ability to transfer huge amounts of money instantly with crypto kind of facilitates this kind of crime. It makes it attractive.
At the same time,

Speaker 1 in this case, the crypto was able to be clawed back almost just as instantly.

Speaker 2 Yeah, it is an interesting duality. I think a lot of criminals and people in the world in general think crypto is anonymous, crypto is

Speaker 2 suited to crime. But in fact, in a lot of cryptocurrencies, every transaction is public.
And so that actually makes it really a treasure trove of information for investigators.

Speaker 2 And it does make it a little bit more difficult to launder that money once it's stolen.

Speaker 1 Did the attackers get away with it? Are they still at large?

Speaker 2 Well, when they freed Belan, they arrested a bunch of people and another 25 people were arrested in recent days and many of them were charged as, you know, linked to more recent kidnappings and others.

Speaker 2 So the question is, are they the organizers or are they just,

Speaker 2 as they'd say in French, petit ma, little, you know, helpers?

Speaker 2 And it does seem that most of them are young. Some of them are minors.
They're recruited online. They don't actually know the entirety of the scheme.

Speaker 1 They're just hired guns.

Speaker 2 Yeah, they're hired guns. And unfortunately, it means that the people who were profiting from the crime may still be at large.

Speaker 1 A few weeks ago, Moroccan authorities arrested a 24-year-old French man who they suspect was a ringleader in some of the recent abductions.

Speaker 2 The theory among investigators in France is that these cases are linked.

Speaker 2 One of the people who was actually arrested in the Killian Desnos case is suspected to have actually been in contact while in prison with the kidnappers in

Speaker 2 the Ballon case. And interesting.
Okay.

Speaker 2 Then the question is, is that person, is that guy who himself is pretty young in his 20s, was he the one who was in charge or is he also a hired hand?

Speaker 1 Despite these recent arrests, the risk of wrench attacks seems to be growing. That's because people who own crypto are increasingly seeing their personal information leaked online.

Speaker 1 A few years ago, Ledger, the crypto company Belong co-founded, had one of its databases hacked. Information for over 200,000 customers was made public.

Speaker 1 A person familiar with the Ledger breach said that Belong's home address wasn't included in that information. And earlier this year, Coinbase, a major American crypto exchange, was also hacked.

Speaker 2 Coinbase basically came out and said that as many as 97,000 customers had had their personal information stolen from them. And And that included things like their balanced snapshots.

Speaker 2 So, you know, how much crypto they have? How much crypto they have, which is basically the target on your back,

Speaker 2 but also their addresses in some cases. And, you know, the company said that data had been likely stolen by a bribed contractor or possibly employees who are working customer support.

Speaker 1 So this is information that says, here's exactly how much crypto these people have. Here's how rich they are.
Here's where to find them.

Speaker 2 Exactly. In some cases, at least, that's the information that was hacked.

Speaker 1 Coinbase said, it's working with law enforcement to investigate the incident and is taking other measures to harden its defenses.

Speaker 1 What do these wrench attacks say to you about kind of the moment we're in with crypto?

Speaker 2 That's a good question. What do they say to me about the moment we're in with crypto?

Speaker 2 It shows how crypto is becoming that much more important and mainstream. The value of assets in in crypto has grown significantly.
It's become a magnet for criminals.

Speaker 2 And yet at the same time, more and more people are holding it, which creates a wealth of new targets. It's also a sign that perhaps it's still a somewhat immature ecosystem.

Speaker 2 One of the things that's most attractive about crypto is that it does not rely on the traditional banking system.

Speaker 2 And it allows you to basically conduct transactions with people you don't trust without having to rely on a trusted third party, that you can live your life without the need for some central authority.

Speaker 2 And the question is, you know, how much that vision of a distributed world coincides with the sort of security that we expect today.

Speaker 1 That's all for today, Friday, June 20th.

Speaker 1 The journal is a co-production of Spotify and the Wall Street Journal. Additional reporting in this episode by Angus Barrick and Bob McMillan.

Speaker 1 The show is made by Catherine Brewer, Pia Gadkari, Carlos Garcia, Rachel Humphreys, Sophie Kodner, Ryan Knudsen, Matt Kwong, Colin McNulty, Jessica Mendoza, Laura Morris, Enrique Perez de la Rosa, Sarah Platt, Alan Rodriguez-Espinosa, Heather Rogers, Pierce Singey, Jivika Verma, Lisa Wang, Katherine Whalen, Tatiana Zemise, and me, Annie Minoff.

Speaker 1 Our engineers are Griffin Tanner, Nathan Singapock, and Peter Leonard. Our theme music is by So Wiley.

Speaker 1 Additional music this week from Marcus Bagala, Peter Leonard, Bobby Lorde, Emma Munger, Nathan Singapock, and Griffin Tanner. Fact-checking by Mary Mathis, Jennifer Gorin, and Kate Gallagher.

Speaker 1 Thanks for listening. See you on Monday.