305 Attacks. 57 Countries.
Physical attacks on cryptocurrency holders are accelerating. Not gradually. Explosively.
We've spent the past few months building the most comprehensive database of kidnapping, ransom, and physical violence targeting people who hold crypto or extracting traditional wealth through cryptocurrency rails. Now we are releasing the full analysis.
We've spent the past few months building the most comprehensive database of kidnapping, ransom, and physical violence targeting people who hold crypto or extracting traditional wealth through cryptocurrency rails. Now we are releasing the full analysis.
Kidnapping, Ransom, and Physical Attacks: Challenges in Cryptocurrency Security documents 305 cases across 57 countries, from 2014 through February 2026.
The Recent Escalation
In 2024, there were 43 attacks registered by the media and online resources. In 2025, that number hit 76. That's a 77% increase in one year. The first six weeks of 2026 have already logged 12 cases, and counting. At the time of publishing, there are more than 2 such attacks per week.
The 2017-2018 cycle saw cases jump from 12 to 29. The 2021 cycle peaked at 36. The current cycle has blown past every previous record, and it's still going.
While the historical correlation suggests that future Bitcoin price increases will correspond with elevated physical attack risk, there are indications that crypto-targeted physical crime may be establishing itself as a self-sustaining criminal category independent of market cycles. The continuing escalation in early 2026, with 12 cases in the first six weeks despite a significant Bitcoin price correction from its 2025 highs, suggests that criminal networks, operational knowledge, and targeting
infrastructure developed during the 2024-2025 surge may persist regardless of price direction. If this pattern holds, the threat model shifts fundamentally: rather than requiring proactive security measures primarily during bull market periods, cryptocurrency holders may face sustained physical risk as an inherent feature of the asset class.
infrastructure developed during the 2024-2025 surge may persist regardless of price direction. If this pattern holds, the threat model shifts fundamentally: rather than requiring proactive security measures primarily during bull market periods, cryptocurrency holders may face sustained physical risk as an inherent feature of the asset class.
Attack Methods
Kidnapping and home invasion together account for 45.9% of all documented cases. These aren't opportunistic grabs. They're planned operations involving surveillance, research, and often weeks of preparation.
The biggest shift: social engineering. Criminals are building trust over weeks or months with smaller business deals, manufactured friendships, investment opportunity or dating app traps. In 2017-2018, we have documented 2 social engineering cases. In 2025 alone, there were 13.
The attackers have professionalized, investing time and resources in target research and selection.
Violence
These are the confirmed numbers. actual rates are likely much higher.
- at least 47.2% involved confirmed torture or physical violence
- at least 51.5% involved confirmed weapons (firearms, knives, tasers, improvised weapons)
- at least 58.4% involved detention (victims restrained, confined, or prevented from leaving)
- at least 7.5% involved drugging or spiking
- 23 people died across 19 fatal incidents
Kidnapping carries the highest fatality rate at 10.7%. Home invasions follow at 4.6%. The overall survival rate is 93.8%.
Geography
Attacks have been documented in 57 countries across every inhabited continent. Western Europe leads with 28.2% of cases, followed by Asia Pacific (25.2%) and North America (22.6%).
The United States has the most cases in absolute terms (53), followed by France (32) and the UK (23). Per-capita however looks different: Sweden, Belgium, Hong Kong, the Netherlands and France top the list when adjusted for cryptocurrency adoption.
French Crisis
France deserves its own section. Between 2017 and 2024, France recorded 4 cases. In 2025 alone, there were 20. The first six weeks of 2026 added 8 more.
The Ledger co-founder kidnapping in January 2025, where David Balland had a finger severed over a 10 million euro ransom demand, appears to have triggered a copycat effect. But the causes go further than that. The 2020 Ledger database breach exposed 272,000 customer home addresses, including 9,500 in France. A concentrated cryptocurrency industry, a regulatory environment that mandates disclosure of self-custody holdings, a reported case of a French tax employee selling crypto investor home addresses to criminal contacts, these might all be reasons for France quickly becoming one of the most dangerous country in the world for cryptocurrency holders.
Theft Success Rates
Not every attack results in theft. Success rates vary widely by method.
P2P trade ambushes have an 84.4% theft success rate, the highest of any scenario. Assault and mugging follow at 83.3%. Kidnapping, despite being the most violent, sits lower at 62.7%. Quick, opportunistic attacks are more likely to succeed. Extended operations give victims and law enforcement more time to respond.
Dodged attacks, although showing a 0% theft success rate, should still be considered a failure of operational security. These are cases where the victim was identified and targeted, but circumstances prevented the attack from unfolding or succeeding. A dodged attack is not good news. It means someone was already watching.
The Targeting Ecosystem
The paper maps how victims might be identified. It's not random. There's an ecosystem:
1. Social media exposure. The most common vector. Posting about investments, displaying assets, discussing profits publicly.
2. Data breaches. Ledger (272,000 addresses), Coinbase (69,000+ users), Gemini (100,000+ users). In April 2025, an aggregate database containing 18 million users from 20+ platforms was sold for $10,000.
3. Blockchain analysis. Linking wallet addresses to real identities through on-chain patterns.
4. Insider information. Service providers, employees, business associates, romantic partners.
5. Conference attendance. Public speakers and known attendees are high-value, easily locatable targets.
6. Public records. Tax records and property registries, particularly in Scandinavian countries with transparency laws.
Most victims didn't become targets by accident. They were found through systems designed to make people findable.
The Core Problem
Decentralization, irreversible transactions, no intermediaries. These are cryptocurrency's strengths until the threat is physical. There's no fraud department to call. No chargeback to initiate. No bank to freeze the account. When someone with a weapon demands a seed phrase, the security model of self-custody reduces to one person's ability to respond.
The paper compares the economics directly: a bank robbery might yield eg. $5,000-$20,000 against armed guards, cameras, dye packs, and time locks. A crypto "wrench attack" potentially worth millions against minimal preparedness, with irreversible transactions and minimal physical evidence.
The economics favor the attacker and that's what we're seeing play out.
What Can Be Done
The paper includes specific recommendations for individuals, exchanges, and policymakers:
For individuals:
- Physical security is not optional for significant holders
- Operational security (not revealing holdings) is the primary defense
- Prevention means not becoming a target, not surviving an attack
For exchanges and custodians:
- KYC residential address requirements create physical targeting databases
- Breached data enables attacks years after the breach
- The industry should advocate for regulatory reform minimizing location data collection
For policymakers:
- Mandatory disclosure requirements need physical security impact assessments
- Public access to tax records creates targeting opportunities
- Enforcement should prioritize protection from violence, not administrative compliance
Read the Paper
The full paper is available in PDF and EPUB formats. The underlying database is searchable at stats.gart.io, with interactive visualizations updated as new cases are documented.
Download (PDF, epub)
Hope is not a strategy.
Understand the threat. Act accordingly.