In response to escalating threat, traders are hiring security firms to minimise their online footprints and remove any personal information that could pose a risk. — Bloomberg via Getty Images
To maintain an edge in the volatile, non-stop world of cryptocurrency trading, it helps to be chronically online. Telegram, Discord and Reddit forums are full of investors swapping tips, memes and – when they get lucky – posting screenshots of gains. Flexing big-ticket purchases like sports cars and designer watches is an easy way to signal credibility and clout.
Such flashy displays, however, aren’t only attracting attention from envious onlookers, but also criminals on the lookout for clues that could help them put a real name or address to a pseudonymous trader.
As the price of bitcoin and other cryptocurrencies has surged over the past three years, so too have so-called "wrench attacks” – the violent kidnappings, beatings, and even finger amputations used to coerce victims into surrendering their holdings. In May, two men were arrested in Manhattan for taking an Italian crypto trader hostage, and a crypto CEO’s daughter narrowly avoided abduction in Paris after masked men attempted to pull her into a van. Last month, an armed attacker posing as a delivery driver broke into a victim’s home in San Francisco and stole US$11mil (RM45.31mil) in cryptocurrency.
About 60 such attacks have been documented globally this year, according to a database maintained by Jameson Lopp, co-founder of cryptocurrency security company Casa, resulting in tens of millions of dollars in losses. That’s up from about 40 in 2024, though some believe the true number is far higher. Ari Redbord, global head of policy at blockchain investigations firm TRM Labs, says violent crypto thefts are "woefully underreported,” as victims often refuse to come forward.
In response to this escalating threat, traders are hiring security firms to minimise their online footprints and remove any personal information that could pose a risk. They’re also taking real-life precautions. The term "wrench attack” comes from a webcomic whose punchline is that even the most sophisticated encryption is useless against a password-seeking attacker armed with a wrench.
The same people who were "all about buying Lambos, going to the moon, posting screenshots of their crypto wallets,” said Charles Finfrock, founder of private intelligence and security company Vigilance, are the ones now saying, "I probably made a mistake. I need to reduce my literal attack surface. Help me.”
Finfrock, a CIA veteran who previously oversaw global information security investigations for Tesla, has seen an influx of business from crypto traders worried about their physical safety. Security firms like BlackCloak, which helps executives protect their online profiles, and Solace Global, which provides physical and cybersecurity to high-net-worth individuals, are now promoting their services to crypto holders. DeleteMe, a company that helps people scrub their information from the web, has seen the number of crypto-company employees using its service triple over the past year.
When Finfrock gets a new client, his first move is to trawl the web for clues about where they live and how much they’re worth. He’ll look for property records, check whether the floorplan of their house is still available on a realtor’s website, and use satellite imagery to see if he can identify their vehicle. Then he’ll map out the client’s family and friends. Even something as seemingly anodyne as a Thanksgiving photo can help criminals identify targets or plan an abduction.
The rise in physical attacks appears to correlate not just with the climbing price of Bitcoin but also with its broader adoption, said Marilyne Ordekian, who wrote a paper on the phenomenon in 2024. According to her data, many of the victims weren’t millionaires, but people with what she described as "middle-class savings” - that is, thousands or tens of thousands of dollars in their crypto accounts. Even that can be enough to attract the wrong kind of attention.
In the coming year, Solace Global predicts that criminals will increasingly target individuals with "smaller but still significant holdings” as high-net-worth investors take greater security precautions.
Compared to conventional investors, cryptocurrency holders tend to have fewer institutional protections. More than half of traders have "self custody,” over their wallets, meaning that they control their own private keys rather than giving that power to an exchange like Coinbase or Binance. And while money transferred out of traditional bank accounts is often readily traceable, the blockchain’s relative anonymity makes recovering stolen funds all that much harder.
If an attacker is forcing somebody to wire them money under duress, Finfrock explained, a bank might be obligated to compensate the victim. "But with crypto I own the entire transmission mechanism – that’s the biggest difference and that’s what makes it so dangerous.”
Still, some safeguards can be implemented to better secure crypto transfers. Owners can set up "multi-signature” wallets, meaning that two or more keys – kept in different locations or even by different people – are needed to authorise a transaction. They can also implement timelocks, which delay money transfers for several days once they’ve been initiated.
Eric Larcheveque, a co-founder of the crypto security firm Ledger, had such measures in place when he received a video showing the severed finger of his co-founder David Balland. Ballard and his wife had been abducted from their home in central France, and the kidnappers were demanding €10mil (RM47.9mil) in ransom.
Larcheveque wouldn’t go into detail about his digital security, only saying that it bought him some time. Not all of the ransom was paid, and according to prosecutors, almost all of the transferred funds were traced, frozen and eventually seized. Balland and his wife were rescued two days later and 10 people have been arrested in connection with the attack.
Since the incident, Larcheveque has gotten stricter about safety. He’s instructed people close to him to be discreet about sharing his personal information, and has banned family members from posting TikToks or Instagram stories that might reveal a real-time location.
To him and others, wrench attacks have made it abundantly clear that there’s no physical safety without digital security.
"If someone wants to take a selfie of me in the street,” Larcheveque said, "I ask them to wait a few hours before they publish.” – Bloomberg
