Crypto Crime Escalates With Kidnappings, Cons and Human Coercion

After a year of kidnappings, assaults and armed home invasions targeting cryptocurrency holders, the industry is racing to harden its defenses.

Conferences are beefing up security. Private firms serving crypto holders say demand has surged. Exchanges are protecting their executives.

The defensive stance was on display at the Bitcoin 2026 conference in Las Vegas last month, where many of the highest-profile speakers moved through the venue trailed by personal bodyguards. A standing-room-only workshop taught attendees how to protect their crypto holdings during a home invasion. The Las Vegas Metropolitan Police Department, The Venetian Resort security team, external contractors and private security all worked together to provide protection, according to Justin Doochin, head of events at BTC Inc., the conference organizer.

A few weeks earlier, at Paris Blockchain Week, guests had been escorted by police motorcade to a VIP dinner and organizers had doubled security around the two-day event.

The technology’s defining transparency, which its adherents have long celebrated as a structural improvement on the opaque plumbing of traditional finance, is the same feature that lets a criminal identify a target.

Physical attacks on cryptocurrency holders rose 75% in 2025, reaching 72 confirmed incidents and $41 million in known losses, according to data compiled by the blockchain security firm CertiK. The figure is widely considered understated, with kidnappings and ransom demands often resolved privately. Jameson Lopp, co-founder of the Bitcoin custody firm Casa, maintains a separate public database that has tracked a roughly threefold increase of known so-called wrench attacks between 2023 and 2025.

Coinbase Global Inc., the largest US crypto exchange, spent approximately $7.6 million on personal security for Chief Executive Brian Armstrong in 2025. That’s a more than 20% increase from the previous year, according to the company’s proxy filings, exceeding what major Wall Street banks typically disclose for CEO security.

“People are thinking harder about getting critical assets physically and operationally further away from their day‑to‑day devices and routine,” said Phil Ariss, director of UK Public Sector Relations at TRM Labs.

At the Vegas conference, which drew thousands of attendees, many high-profile speakers were accompanied by personal security. Among them was Adam Back, who was recently identified by The New York Times as a possible Satoshi Nakamoto, a claim Back has denied.

Security was a central theme. One of the most heavily attended workshops focused on protecting crypto assets under physical coercion. It was hosted by Ben Perrin, who runs a Bitcoin-security YouTube channel with around 400,000 subscribers. Solutions ranged from technical safeguards to practical measures, including setting up decoy wallets, enabling duress features on hardware wallets and using time locks to prevent immediate transfers under coercion.

“Unfortunately, there’s no way to keep yourself off a list,” Perrin said, referring to leaked exchange data being used to identify targets. “And so how do you then hedge against that? People want self-sovereignty but they want to do it right and they’re worried they’re going to mess up.”

The founder of a large crypto protocol said he has moved his digital-asset holdings out of self-custody on-chain wallets and into physical vaults at four separate institutions, splitting his crypto across them as an additional safeguard. Each requires him to physically sign and wait through a seven-day lock period before any withdrawal. To access the full sum now takes him a month. He declined to be named, citing the risk of being identified to kidnappers.

Inflection Point

“2025 marks a clear inflection point: physical violence is now a core threat vector in the crypto ecosystem,” CertiK said in its report.

France has emerged as a particular hotspot. A string of incidents in 2024 and 2025 has targeted the families of crypto entrepreneurs, including a failed daylight kidnapping attempt on the daughter of the chief executive of Paris-based exchange Paymium. Law enforcement in Paris and New York has stepped up efforts to combat a rise in crypto-related kidnappings and extortion cases, while private security firms in Dubai report growing concern about the threat, according to industry experts.

In most documented cases, attackers have identified marks in advance. Public blockchain records, leaked exchange data and chain-analytic tools — available to both investigators and criminals — together produce a legible map of who holds what.

‘Low Risk, High ROI’

“The logic from the adversarial perspective of what the bad actors are seeing is — this is low risk, high ROI,” said Adam Healy, CEO of Station70, a US-based security company focused on digital asset protection. “And if laundered correctly, they can get away with a substantial portion of this.”

Demand for protection has risen sharply. Two years ago, Executive Risk Services, an executive-protection and risk-management firm serving the digital-asset industry, received outreach from prospective clients roughly once a quarter. Now, inquiries come in about once a week.

The corporate response has started to resemble the executive-protection budgets of late-1990s oil majors or pharmaceutical chief executives under animal-rights threat. Crypto exchange Gemini spent about $2.5 million each in 2025 on personal security services for its billionaire co-founders Cameron and Tyler Winklevoss, filings showed. As of January, Gemini had a new agreement to protect the Winklevoss brothers and their family members (as well as others, as needed) at a rate of $400,000 a month plus expenses, though that figure is capped at $1 million for the first year, according to recent regulatory paperwork.

Cameron Winklevoss, right, and Tyler Winklevoss during Gemini’s initial public offering in 2025; photo credit: Michael Nagle/Bloomberg

“Large, regulated exchanges and custodians are increasingly converging on something that looks very close to big‑bank practice for a small group of key personnel — think executive protection for a handful of individuals, secure travel protocols, hardened offices, and internal policies about home addresses and children’s schools not being publicly visible,” said TRM’s Ariss.

The in-person element is not confined to extraction. It has also arrived at the front end of some of the sector’s largest protocol hacks. On April 1, hackers drained roughly $285 million from Drift, a derivatives exchange on the Solana blockchain. The company later described the attack as “six months in the making.” According to Drift, the thieves posed as a legitimate trading firm, met staff at industry conferences, deposited more than $1 million to establish credibility, and spent months embedded inside the project before compromising staff devices through malicious software disguised as a wallet application.

Drift attributed the hack to a North Korean state-affiliated group, an assessment echoed by blockchain analytics firms Elliptic and TRM Labs.

Crypto’s founding proposition was that financial sovereignty could be restored to individuals by removing intermediaries and anchoring wealth to cryptographic keys rather than institutional relationships. That proposition has held. The consequence is that the keys — and the people who hold them — are now the single point of failure. There is no bank branch to call and no regulator to appeal. A stolen key is a final transaction.

“Criminals follow where they believe the money is,” said Healy. “And many crypto-affiliated individuals combine significant wealth with a uniquely difficult threat landscape.”

Photograph: A person types at a backlit keyboard arranged in Danbury, UK, on Thursday, Jan. 7, 2021; photo credit: Chris Ratcliffe/Bloomberg

Related: