Kidnapping and extortion, deadly murders, and serial cases within cases: Five recorded incidents in the cryptocurrency world

Author: Jaleel Jia Liu, BlockBeats

It's hard to imagine someone holding a gun to steal your real estate, but if what you own is a string of easily transferable, globally redeemable cryptocurrencies, then to criminals, it's simply a perfect walking ATM.

According to incomplete statistics from Rhythm BlockBeats on public cases, there were about 7 incidents of "physical layer" crypto kidnappings, home invasions, or violent threats in 2022; by 2023, this number had at least doubled to around 15-18; and in 2024, it continued to grow, with at least 20 incidents, and the average amount involved in each case was higher, with several cases involving ransom or losses exceeding one million dollars; in the first half of 2025 (up to June), at least 34 incidents had occurred, far surpassing last year and setting a historical high. The vast majority of cases belong to the typical "wrench attack," where victims, even with the safest cold wallets and cryptographic defenses, ultimately cannot withstand a knife, a wrench, or a stun baton.

"Wrench attack" originates from a famous XKCD comic: when complex cryptographic defenses are faced with physical violence, all it takes is a wrench to make you obediently hand over your private keys.

Typical methods of these wrench attacks include: breaking into homes directly, threatening with weapons or binding torture to force the victim to hand over mnemonic phrases or make transfers; disguising as police, agents, insurance personnel, Uber drivers, etc., luring the victim into a confined space before attacking; using acquaintances or sexual seduction to ambush, meeting in hotels, apartments, or cars to carry out the act; organized gangs operating transnationally, such as South Asian gangs in Southeast Asia, Russian gangs in Thailand, and Ugandan gangs impersonating military or police.

Bali Tragedy: A Deadly Trap in Paradise

When it comes to cryptocurrency-related kidnapping cases, most people's first impression is the Bali couple tragedy, a case that caused quite a stir in both the crypto and tourism circles.

The date was May 1, 2023, at a five-star hotel in Bali, Indonesia, where a 22-year-old Chinese couple on vacation was found dead under tragic circumstances.

According to the Indonesian police's investigation of testimonies from 31 witnesses and forensic examinations, the official conclusion was relatively straightforward: the male victim first strangled his girlfriend, then stabbed himself with a beer bottle until he was bloodied, and finally took his own life. The police stated that the couple had quarreled over some personal issues before arriving in Bali, and the male victim had also sustained an injury to his left hand, so from the police's perspective, this was a typical "murder-suicide."

However, there was a detail that caused this case to explode in the crypto community—rumors suggested that the deceased was involved in the crypto space, and the male victim might have held cryptocurrencies worth approximately 200 million RMB.

Discussion in the crypto community at the time

A crypto trader with the WeChat name "nnn" spoke out about the incident, claiming the male victim was his friend, and they had chatted about half a month prior.

Before the official determination of the case as a "murder-suicide," most speculations in the crypto community were that someone had targeted this money, wanting to force him to hand over his wallet keys, leading the suspect to take matters into their own hands against both individuals to extract the password, resulting in their deaths and the money going missing.

However, many details about the case surfaced online, such as why the couple checked in separately, with the hotel room registered under the female's name? The first thing the male victim did upon entering the hotel room was repeatedly check the adjacent room and the hallway—was he afraid someone would sneak in through a hidden passage or window? There were no fingerprints found on the beer bottle, as if a professional hitman had cleaned up after their work. Additionally, in a leaked photo of the male victim, he had a small braid, giving off a bit of a "gangster vibe." People in the community said this kind of demeanor and attire is commonly seen among certain gangs in Southeast Asia or Hong Kong and Taiwan.

These numerous details led to a widely circulated version of the case: in Southeast Asia's "gambling" base and telecom fraud zones, it is common to use USDT or various cryptocurrencies for transactions to "clean" money. This young man, holding a large sum of money, allegedly took the "employer's" funds under the pretext of "cleaning" them. Several local OTC traders in Indonesia sold his whereabouts when they helped him exchange USDT for dollars. Upon discovering the money was missing, the "employer" offered a huge bounty to "make an example," and professional hitmen traced him to the hotel and struck, with the method of attack perfectly aligning with gang revenge operations. The "employer" was not a small player; he might have had support from some warlords and corrupt officials in Southeast Asia, and fearing that publicizing this case would scare away a large number of foreign tourists, the local government preferred to suppress it.

Of course, this is just a speculative version circulating in the community and may not reflect the truth of the case. However, due to the mysterious nature and tragic severity of the incident, it has remained very famous in the crypto community. RIP…

According to local Indonesians, this case hardly caused any ripples in the area; the hotel was perfectly fine and continues to thrive. To this day, it is still regarded as a luxurious vacation destination. The sea breeze of Bali has blown through too many news stories related to crypto kidnappings, cold and indifferent, with no connection to the sunshine of a holiday paradise.

For example, in early 2023, there was a rumor circulating in the crypto circle: a crypto blogger named Yuri Boytsov was being targeted. At that time, he had rented a seaside villa in Bali, teaching people how to trade cryptocurrencies on Telegram during the day and enjoying beers by the sea at night. One night, four individuals suddenly burst into his room, one of whom was wearing a police uniform, while the other two were white men with masks. Without saying a word, they pinned him to the ground, stole his phone and passport, and then forced him to unlock his wallet, brutally transferring away $284,000 worth of Bitcoin. Later, the Indonesian police only managed to catch one suspect, who turned around and claimed Yuri was a scammer who deserved to be robbed. In the end, the money was never recovered, and Yuri left in disgrace to another country.

There was also an older case from the end of 2021, involving an Italian couple living in a villa in Seminyak, who were invaded at 3 AM by several individuals. The assailants were dressed in black, wearing gloves and masks, first tying up the male homeowner, pressing a knife to his neck, and sealing his mouth with tape, then demanding his phone password. If he didn't cooperate, they would switch to various forms of beating and threats. Ultimately, their Bitcoin accounts and six mobile phones were completely emptied, amounting to approximately $374,000. Afterward, police discovered that two of the foreign men involved in the crime had previously dined and partied at the victims' home. Currently, police have only apprehended two of them, while the Polish and Russian suspects are still wanted.

Debts Paid by Parents: A Case of Kidnapping and Theft

On August 25, 2024, on a hot and irritating Sunday afternoon, in an upscale community in Danbury, Connecticut, USA, the lawns were neatly trimmed, and freshly cleaned outdoor loungers were set up by the pool. Most residents here are stable and wealthy, making kidnapping incidents quite rare; a police officer might encounter only one in their lifetime.

Sushil was a vice president at Morgan Stanley; although his salary was high, it wasn't to the point of being extraordinarily wealthy. That day, Sushil and his wife were driving their newly purchased Lamborghini, looking at houses in the neighborhood. However, this middle-class couple had no idea that a terrifying nightmare was about to unfold in the next few minutes.

As they turned a corner, a white Honda suddenly slammed into the back of Sushil's Lamborghini. Sushil instinctively hit the brakes and was about to get out to check what happened when another white truck came barreling towards them, completely blocking the Lamborghini. Within seconds, six masked men in black clothing rushed out from both vehicles. They barely gave the couple time to react; the car doors were yanked open, and the couple was dragged out. Sushil shouted and struggled desperately, only to be met with a baseball bat that struck him hard on the head, instantly covering half his face in blood.

The couple was thrown into the back of the truck, tightly bound with tape, wrapped up like mummies, with their mouths taped shut, leaving them only able to breathe through the small gaps in their noses. The truck turned around and sped off, just like in the movies. But while movies are scripted, the couple's fear and suffocation were real, with the metal truck shaking violently, and the kidnappers occasionally hitting them with the baseball bat, each blow causing excruciating pain.

What the kidnappers didn't expect was that an off-duty FBI agent happened to witness everything nearby and immediately reported the truck's license plate number to local police. Within ten minutes, patrol cars intercepted the truck. Seeing the situation was turning against them, the driver began to flee wildly, running red lights and scraping the curbs, creating sparks everywhere. After about a mile, the vehicle finally lost control and crashed into a roadside barrier. Four kidnappers jumped out of the vehicle and fled into the woods and under the bridge, but were ultimately apprehended by the police.

The rescued couple was injured all over, their legs still bound with tape, and their faces covered in blood. Strangely, law enforcement discovered that the suspects, aged between 18 and 26, had rented a car in Miami specifically to drive to Connecticut. The distance from Miami to Connecticut is about 2100 kilometers; even without stopping, it would take 20 hours of continuous driving. What could this couple possibly have that would warrant a group of people flying from Florida to Connecticut to kidnap them? Sushil was just an investment banking executive; while his salary was high, if they were after money, they could have just stolen the car instead of going through the elaborate process of kidnapping.

The truth slowly pieced together afterward. Police examined several suspects' phones and looked at their group chats, discovering that the real target of this group was not the couple but their son—Veer Chetal, an 18-year-old high school graduate, which even led to a $250 million cryptocurrency theft case.

Veer Chetal, photo provided by the U.S. Marshals in March 2025

Chetal's identity was not simple; during the day, he attended Rutgers University in New Jersey, but at night, he was a crypto thief.

Last August, Chetal and several friends he met in the Minecraft game black market formed a "cybercrime gang," using a set of outdated but effective social engineering tricks to impersonate Google and the crypto trading platform Gemini customer service, stealing 4,100 Bitcoins from an early Bitcoin player in Washington in batches, worth $250 million at the time, and valued at $420 million at the time of writing.

After getting the money, Chetal and his gang lived extravagantly, spending millions on cars, jewelry, renting luxury homes, and partying at nightclubs. He drove a Lamborghini to school, frequently visited nightclubs, and constantly switched luxury cars, attending one party after another.

It was at a nightclub in Miami that the young and impulsive Chetal had a dispute with one of the kidnappers, which eventually escalated into a physical confrontation. The kidnappers then learned that Chetal possessed a large amount of cryptocurrency, so they flew from Florida to Connecticut, planning to first capture his parents as hostages and then force Chetal to hand over the remaining money—this was the very afternoon when the Lamborghini was rear-ended.

Chetal was connected to at least dozens of similar small to medium-sized scams, with smaller ones amounting to tens of thousands of dollars and larger ones reaching two to three million dollars. Police searched his home and found $500,000 worth of luxury jewelry and cash, as well as $39 million in cryptocurrency.

According to court documents released this week, Chetal has pleaded guilty and agreed to testify in exchange for a reduced sentence, potentially facing around 20 years in prison. Born in India, Chetal came to the U.S. with his family in 2010 when he was four years old, obtaining a related dependent visa due to his father's foreign worker visa, but he might be deported due to this criminal case. Chetal's father also lost his job at Morgan Stanley because of this incident.

The Lamborghini that once flaunted status now sits lonely in a Connecticut police parking lot.

Hal Finney's Last Extortion Call

If there is anyone in the Bitcoin community recognized as a "white moonlight," Hal Finney would undoubtedly be on the list. Even though he denied being the founder of Bitcoin, many believe he is Satoshi Nakamoto.

He was the first person to receive a Bitcoin transfer from Satoshi Nakamoto, one of the earliest to understand Bitcoin, and a very early contributor of Bitcoin's computing power and code. Yet, in the last few months of his life, this individual could not leave the world quietly.

Hal Finney with his wife Fran

It was the winter of 2014, and Hal Finney had been battling ALS for five years, losing most of his bodily functions, with swallowing becoming a dangerous act. His wife Fran had to suction him, wash him, and change his tubes every day. That morning, while she was bathing Hal with a caregiver, the phone suddenly rang. The caller claimed to be from the 911 emergency dispatch center, speaking politely: "Ma'am, is someone in your home being attacked right now?"

Fran was confused, and the dispatcher continued slowly, "Please remain calm; your home will soon be surrounded by SWAT. We need your cooperation; come out immediately." She walked to the door, and outside were fully armed SWAT officers, with helicopters buzzing overhead. A few days earlier, there had been a shooting incident involving college students nearby, and the police were particularly tense. Seeing her on the phone, they shouted, "Drop the phone! Come out to the lawn!"

She had no choice but to comply, leaving Hal, who was still in the bathroom waiting for suction, unable to move, along with the caregiver and their son. Hal was then carried out to the lawn by the SWAT team, the wind making him shiver, his throat filled with saliva, and Fran feared he would choke to death, nearly breaking down.

All of this was a case of "swatting" (maliciously reporting a false incident leading to the dispatch of SWAT). The hacker used a spoofed caller ID to call 911, falsely claiming, "I just killed someone and am about to commit suicide," intending to scare the innocent family with armed SWAT officers storming into Hal Finney's home.

The person behind the call had begun extorting Hal Finney's family a month earlier, initially demanding 1,000 Bitcoins—worth over $400,000 at the time. Although this amount was not much for Hal Finney, as he was an early Bitcoin miner, it was evident that most of it had gone towards expensive ALS medical expenses.

While this case did not endure direct kidnapping torture, the hacker's repeated threatening calls and threats of exposure painfully tormented this legendary figure lying on a respirator. Hal Finney's health deteriorated day by day; he had lost the strength to speak normally but still had to muster the remaining emotions and strength to confront an extortionist hiding in the shadows. Fran later stated in an interview that "this took away his last peace."

Until August 28, 2014, Hal Finney passed away.

The Nightmare of Ledger's Co-Founder on a Snowy Night

If Hal Finney's experience is an unforgettable story from the early days of Bitcoin, then the kidnapping case of Ledger co-founder David Balland is one of the most well-known kidnapping cases involving figures in the crypto industry that has occurred recently.

In the early hours of January 21, 2025, the winter night in the small town of Méreau in central France was eerily quiet. Just after 2 AM, a van quietly parked outside a white-walled villa with a garden. The people inside had no idea that their nightmare had already stepped in, treading through the snow.

The target was not an ordinary resident but David Balland. Even if he wasn't a household name in the crypto space, he was certainly a well-known figure. He is the co-founder of Ledger, a prominent cold wallet company in the crypto industry, and a benchmark in the hardware wallet sector.

David Balland, co-founder of Ledger

As a co-founder of the company, David Balland has been fully involved since Ledger's establishment in 2014 and served as the director of the Vierzon factory from 2019 to 2021. In 2019, Ledger set up a dedicated factory in the central French town of Vierzon to produce hardware wallets. The company is currently headquartered in Paris, with around 700 employees. In 2023, the company successfully raised €100 million (approximately $104 million), with a valuation reaching €1.3 billion.

David retired from Ledger in 2021 and went on to found two new startups: Le Centre and Ocel. Both companies aim to bring museums and art into the Web3 + VR space.

David had previously posted a photo of his new home on Twitter

That night, David was at home with his partner, the curtains half-drawn, the flames dancing in the fireplace, and everything seemed normal. But just a few minutes later, the door was kicked open, and a group of armed individuals stormed in, dragging the two out of bed and binding them without a word. A chill swept through the house, mixed with two thoughts racing through David's mind: whether they would survive and what the kidnappers wanted.

He was roughly shoved into a vehicle and dragged to an abandoned warehouse several dozen kilometers away. It was as cold as an ice cellar there, and the kidnappers bound him tightly with tape, even using a knife to torture him, forcing him to open up and transfer the ransom in cryptocurrency. He was compelled to message another co-founder of Ledger, with the ransom amount clearly stated: only accepting cryptocurrency, no police involvement, no delays, or else they would face the consequences.

The warehouse where David was held

His partner was not spared either; she was separately taken to a small town south of Paris and confined in the backseat of a van. Cold air seeped in through the gaps in the vehicle, and she was bound all over, her limbs numb and devoid of sensation, only able to listen to the occasional sounds of passing cars outside, hoping someone would notice.

The kidnappers were very knowledgeable: they contacted for the ransom via WhatsApp, using a phone number registered in Southeast Asia and routing through several VPNs. Ledger was hesitant to take hardline action and initially transferred a portion of the ransom to buy some time for the police to trace the leads.

For the kidnappers, this was just money; for the French police, it was a matter of dignity. 230 gendarmes, 91 members of the French Gendarmerie Intervention Group, along with cybersecurity and intelligence teams, worked tirelessly to lock the license plates, track the phones, and launched a night raid. From the kidnapping to the rescue, the French police took less than 48 hours.

French police statement regarding the case

On the afternoon of January 23, in the suburbs of Paris, two suspicious vans were intercepted by the police just as they parked on the roadside. Inside the vehicles were three men and the partner who had been bound in the backseat, her face pale from the cold. When the police pulled her out, she was nearly hypothermic, unable to even scream. Meanwhile, David was also rescued from the warehouse; he was alive, but in the hostage video, the kidnappers had indeed used a knife to threaten Ledger for the ransom, even cutting off one of his fingers to send a bloody video to the company's executives, a scene that sent chills down the spine.

Ten kidnappers were arrested on the spot: 9 men and 1 woman, aged from their early 20s to over 40, most of whom had prior criminal records, with the mastermind being a 24-year-old Franco-Moroccan. This arrest was just the first step; they faced multiple charges including "organized violent kidnapping," "armed extortion," and "torture and abuse"—in France, the maximum penalty can be life imprisonment.

After being rescued, David was taken to the hospital for treatment; his hand injury would take time to heal, but more importantly, he was alive.

The "E-Guardian" Who Drugged His Father

That cup of tea was brought to him by his son.

In May 2021, in Bethesda, Maryland, a typical middle-class affluent area, with dappled shadows from trees and clean streets, any incident could stir the entire neighborhood. That night, Liam brought a steaming cup of tea to his father, secretly sprinkling a bit of white powder into it, smiling as he encouraged his father, "It's good for your health, just a little pick-me-up."

His father thought nothing of it and drank it. Although his son had a drug habit, he was still the child he had raised, the only son they had shared moments of trading cryptocurrencies and meals, arguing and reconciling. But after that cup of tea, instead of a good night's sleep, he fell into a two-day coma, nearly losing his life.

The powder was not a supplement but a benzodiazepine sedative—similar to prescription sleeping pills, a high dose enough to make someone without tolerance lose consciousness immediately.

Evidence of the tea Liam gave to his father, source: case evidence files

That night, after Liam knocked his father out, he quietly took his father's phone, bypassed two-factor authentication, and transferred $400,000 worth of Bitcoin from his account to himself, converting most of it into Ethereum.

After doing all this, he left a note: "I'm not a bad person; I just want to help you and myself. I will ensure you have the best retirement life."

This note written by Liam to his father is one of the pieces of evidence in the case, source: case evidence files

He thought his father would wake up soon, but he overlooked the fact that a non-addict has almost zero tolerance for such drugs. Two days later, a friend noticed that the father had been unreachable for several days and, panicking, reported it to the police. When the police broke in, they found him collapsed on the bedroom floor, weak, severely dehydrated, and his organ functions beginning to fail.

Doctors said if they had been a few hours later, he would have died.

Liam was born into a middle-class family in Maryland. After his parents divorced, he was the only child. He was good at tennis as a child and started an online consignment clothing business after graduating high school, later becoming obsessed with cryptocurrency, and began acting as his father's "financial advisor."

"You are always too emotional and too attached to this token," Liam would often advise his father.

His father gave him $100,000 as capital, and as the account value soared, they cashed out some of their cryptocurrency holdings in 2018, earning about $350,000 in after-tax profits. However, Liam's drug use began to deteriorate sharply, and he would often be found unconscious, moving from his apartment to his family's home, and eventually going missing.

As his son's suspicions grew, so did his obsession with the plummeting Bitcoin price. At that time, his father worried about his son's judgment and locked their investment account with dual authentication.

"Dad, you need to sell it," the father recalled his son telling him. "No, you need to stop using drugs," the father replied.

Thus, that cup of tea appeared. After moving furniture, they had dinner nearby, and when they returned home, Liam brought out two cups of "special" tea, one for himself and one for his father.

After pleading guilty, Liam underwent drug treatment and rehabilitation, source: The Washington Post

After the police got involved, they initially filed the case as "attempted murder," given that the father had nearly lost his life. However, upon further investigation, prosecutors found it more akin to a crime committed by an addict out of control, driven by a "good intention delusion"—he never intended to actually kill anyone. The case ultimately concluded with a first-degree assault charge. Considering Liam had no prior record, cooperated with treatment, and his family chose to forgive him, the court sentenced him to 125 days in jail plus mandatory drug rehabilitation, along with 20 years of probation. If there was any further violence, he would immediately go to state prison.

Upon leaving the cell, Liam moved into a rehabilitation group home in Rockville, working odd jobs during the day and attending drug recovery support meetings at night. His father would visit him, and sometimes they would work together on his old Subaru. "I apologized to my dad, but I know that just saying sorry isn't enough," Liam said. "I want to show him through my actions that I am truly becoming that good son again."

Perhaps this father and son will share tea again, but this time, the father will likely smell it first before drinking.