Severed Fingers and Wrench Attacks: A New Era in Crypto Crime

Summary

The Journal: Severed Fingers and Wrench Attacks — A New Era in Crypto Crime

Released June 20, 2025 | Hosts: Ryan Knutson and Jessica Mendoza | Co-produced by Spotify and The Wall Street Journal

---

Introduction

In the latest episode of The Journal, hosted by Ryan Knutson and Jessica Mendoza, the discussion delves into the alarming rise of violent crimes targeting cryptocurrency holders, a phenomenon now termed "wrench attacks." These attacks represent a dangerous convergence of physical violence and digital wealth, highlighting the vulnerabilities within the burgeoning crypto ecosystem.

---

Understanding Wrench Attacks

Definition and Origin

Wrench attacks, officially known as "$5 wrench attacks," are a modern twist on traditional kidnapping for ransom, where perpetrators seek payment in cryptocurrencies instead of conventional currencies. The term originates from an xKCD comic strip that juxtaposes the sophisticated, unattainable methods of hacking crypto accounts with the blunt, violent approach of using a literal wrench to extract passwords (04:00–04:55).

Quote:

"The full term for a wrench attack is a $5 wrench attack... it's the brute force approach."
— Sam Schechner [04:38]

---

High-Profile Cases Illustrating Wrench Attacks

1. The Paris Kidnapping Attempt

Early on a Tuesday morning in Paris, attackers in black masks attempted to abduct a 34-year-old woman linked to Paymium, a French cryptocurrency exchange. The violent assault was partially captured on video, showcasing the desperate measures the assailants took to extort crypto-based ransom (00:05–02:19).

Quote:

"They pepper spray the family and try to drag her into that truck... eventually, they sped off while a bike shop owner attempted to intervene."
— Sam Schechner [00:24–01:39]

2. The David Balon and Ledger Incident

David Balon, co-founder of the prominent crypto company Ledger, was brutally abducted in central France. The kidnappers demanded a ransom of 10 million euros in Tether cryptocurrency, escalating their threats by severing Balon's pinky finger as coercion. The ordeal ended with Balon's rescue and the recovery of most of the ransom through coordinated efforts involving law enforcement and crypto exchanges (09:27–12:46).

Quote:

"Within hours of the abduction, other Ledger co-founders heard from the kidnappers demanding a ransom of 10 million euros in Tether."
— Annie Minoff [09:39]

3. Other Notable Incidents

• Manhattan Bitcoin Kidnapping: Three teenagers were arrested for attempting to rob a man of millions in cryptocurrency through kidnapping and torture.

• Estonia Escape: An Australian crypto billionaire narrowly escaped an abduction in Estonia.

• Houston Showdown: A Houston-based crypto influencer's husband engaged in a shootout with home invaders seeking her laptop.

• New York Crypto Kidnapping Scheme: Police arrested multiple individuals connected to a prolonged kidnapping of an Italian crypto investor.

---

Drivers Behind the Surge in Wrench Attacks

Rising Crypto Valuations

The significant increase in cryptocurrency values, particularly Bitcoin surpassing $100,000, has made digital assets a lucrative target for criminals (05:01–05:49).

Enhanced Security Measures Online

As crypto holders adopt self-custody solutions—storing their private keys offline to protect against online breaches—the physical security of individuals becomes the new vulnerability. Devices that keep keys air-gapped from the internet have pushed criminals towards more direct, violent methods to access digital wealth (05:49–06:13).

Quote:

"Self custody... keeps the keys offline, but it won't help if someone threatens you with violence to extract your key."
— Annie Minoff [06:13–06:26]

---

Target Demographics: Crypto Influencers and Executives

Visibility Breeds Vulnerability

Individuals who publicly disclose their crypto holdings, such as influencers and business executives, have become prime targets. The public display of wealth on platforms like YouTube, Twitch, and social media exposes them to heightened risks.

Case Study: Kilian Desnos (Twiffer)

Kilian Desnos, known as Twiffer, faced a kidnapping attempt after openly sharing his crypto successes online. In August 2023, his father was abducted, and a ransom video was sent, prompting Desnos to pay the ransom and secure his father's release. This incident underscored the peril of flaunting crypto wealth (07:00–08:11).

Quote:

"Being an online influencer, a crypto influencer is becoming a more dangerous game these days."
— Sam Schechner [06:37–07:00]

---

Law Enforcement and Criminal Networks

Arrests and Connections

Multiple arrests have been made in connection with wrench attacks, including young individuals and minors recruited online. Investigations suggest a network of organized criminals orchestrating these kidnappings, though many arrested individuals may merely be enlisted muscle rather than masterminds.

International Linkages

There are indications that orchestrators operate across borders, with suspects in one case having connections to others. For instance, a person arrested in the Kilian Desnos case was suspected of liaising with kidnappers in the Balon case, suggesting a broader, interconnected criminal network (13:12–14:37).

Quote:

"They're hired guns... the people profiting from the crime may still be at large."
— Sam Schechner [13:48–13:58]

---

The Double-Edged Sword of Cryptocurrency

Advantages for Criminals

Cryptocurrencies offer rapid, untraceable transfers, making them attractive for ransom payments. However, the transparent nature of blockchain transactions also provides law enforcement with critical tools to track and potentially recover stolen funds.

Recovery Success in the Balon Case

In the Balon incident, the coordinated efforts between Balon's associates and crypto exchanges enabled the rapid clawback of most of the 3 million euros sent as ransom, demonstrating that while crypto facilitates crime, it also assists in financial recovery when leveraged correctly (12:23–13:12).

Quote:

"In fact, in a lot of cryptocurrencies, every transaction is public. It actually makes it a treasure trove of information for investigators."
— Sam Schechner [12:46–13:12]

---

Impact on the Crypto Ecosystem and Future Outlook

Growing Criminal Attraction

As crypto becomes more mainstream and its asset values soar, it continues to attract criminal interest. The rise in high-profile wrench attacks signifies a maturing yet vulnerable ecosystem where digital and physical securities must evolve in tandem (16:05–17:15).

Security vs. Decentralization Dilemma

Cryptocurrency's foundational ethos emphasizes decentralization and minimal reliance on central authorities. However, the increase in violent crimes against individuals poses questions about the balance between maintaining decentralized principles and ensuring robust security measures to protect holders (16:05–17:15).

Quote:

"The value of assets in crypto has grown significantly. It's become a magnet for criminals... how much that vision of a distributed world coincides with the sort of security that we expect today."
— Sam Schechner [16:05–16:43]

---

Conclusion

The episode paints a sobering picture of the intersection between rising cryptocurrency values and the escalating creativity of criminal tactics. Wrench attacks exemplify the challenges that come with the digital age's wealth management, where traditional security measures are juxtaposed against innovative, albeit nefarious, methods of accessing digital assets. As the crypto landscape continues to evolve, so too must the strategies to protect its participants from such unprecedented threats.

---

This summary captures the key discussions and insights from the episode "Severed Fingers and Wrench Attacks: A New Era in Crypto Crime," providing a comprehensive overview for those who have yet to listen.

Transcript

[Annie Minoff]

The attack happened early on a Tuesday morning in Paris.

[Sam Schechner]

It's maybe 8:30 in the morning. You know, people are taking their kids to school or daycare. Businesses are opening up, people are having their coffee.

[Annie Minoff]

That's our colleague, Sam Schechner.

[Sam Schechner]

A white delivery van pulls up and three men dressed in black masks jump out and grab a 34 year old woman while she's walking with her husband and her two year old toddler.

[Annie Minoff]

Onlookers captured the attack on video.

[Sam Schechner]

They pepper spray the family and try to drag her into that truck and she screams and the husband throws himself in front of her and grabs onto her for dear life and won't let. And they're trying to pull her away. You know, she's screaming, help, help, help. And you know, let go of me. Let go of me, damn it. Eventually, more people start coming and a guy who runs a bike shop right nearby runs out of the building holding a fire extinguisher. And he kind of runs at the attackers and they just hopped in the back of that white van and sped off while the bike shop owner just sort of threw the fire extinguisher. After barely missing the back of the van as it sped around the corner.

[Annie Minoff]

The assailants fled the scene, leaving the woman, her bloodied husband and her toddler behind. Why did this happen?

[Sam Schechner]

Well, this 34 year old woman, her father is the CEO of a company called Paymium, which is a cryptocurrency exchange based in France. And investigators believe that the kidnappers were attempting to kidnap her in order to get him to pay a large ransom in cryptocurrency.

[Annie Minoff]

Okay, so this was an abduction attempt with the idea of extorting the father.

[Sam Schechner]

This was an old school abduction, extortion with the new school twist that what they wanted to be paid in was crypto.

[Annie Minoff]

This trend of using violence in the physical world to access someone's online wealth has a name. It's called a wrench attack. And wrench attacks on people who own millions in crypto have been growing across the globe. Another suspect was arrested in the bitcoin kidnapping and torture case in Manhattan. Three teens accused of kidnapping and robbing a man out of millions of dollars in cryptocurrency. It comes after a series of kidnappings in Europe targeting crypto magnates. Welcome to the Journal, our show about money, business and power. I'm Annie Minoff. It's Friday, June 20th, 20th. Coming up on the show, a new violent era of crypto crime.

[Unknown Sponsor]

This episode is brought to you by U.S. bank with U.S. bank business essentials, you get more than just a bank. You get a dedicated partner that provides you a powerful combo of checking and card payment processing with quick access to the money you've earned. Proving that there's nothing as powerful as the power of us. Visit usbank.com today to learn more. Member FDIC Copyright 2025 us.

[Annie Minoff]

The full term for a wrench attack is a $5 wrench attack, and it stems from a comic strip on xKCD, an online webcomic that often covers science and tech. In this two panel comic titled Security, two stick figures are trying to hack into someone's crypto account. The first panel depicts, quote, a crypto nerd's imagination.

[Sam Schechner]

One of the stick figures says, his laptop's encrypted. Let's build a million dollar cluster to crack it. And the other stick figure says, no good, it's 4096bit RSA. And then the first one says, blast, our evil plan is foiled.

[Annie Minoff]

The other panel is titled what would actually Happen?

[Sam Schechner]

One stick figure says to the other, his laptop's encrypted, drug him and hit him with this $5 wrench until he tells us the password. Everyone takes the wrench and says, got it.

[Annie Minoff]

So it's kind of the brute force approach.

[Sam Schechner]

Yeah, literally brute force. Not the crypto brute force approach, but, but literal brute force.

[Annie Minoff]

The crypto thefts that you usually hear about happen online with hackers who break into exchanges or scammers who phish people through text messages. But there's always been the more straightforward approach, violence. And this year, wrench attacks have been on the rise. That's for a few reasons. One, crypto is more valuable and more worth stealing than ever before. Prices are way up, especially for Bitcoin, which is currently valued at over $100,000. But another reason is that it's just harder to steal crypto online. These days, the crypto rich have gotten savvier about where and how they store their keysthe string of numbers and letters that give someone access to their crypto wallet.

[Sam Schechner]

Increasingly, what crypto enthusiasts do is something called self custody, which means that you keep it offline, air gapped away from the Internet. There are devices that help you do this. I mean, the old school way would be to write your key down in a notebook, but you know the keys are very long. So instead you usually have a device that you keep the keys offline in your pocket or in a safe somewhere.

[Annie Minoff]

That might insulate you from an online attack. But it won't help you if, for instance, someone breaks into your home and threatens you with violence if you don't give up your key. Who is being targeted in these attacks?

[Sam Schechner]

The main through line we see is people who are well known for having.

[Annie Minoff]

A lot of crypto people like crypto influencers. I've made over a million dollars from crypto.

[Sam Schechner]

Here's my exact trade.

[Annie Minoff]

I made $2 million in 10 months with Bitcoin.

[Sam Schechner]

I'm sitting in this bed in this studio apartment, and I just became a millionaire. Talking about your crypto wealth online. Being an online influencer, a crypto influencer is becoming a more dangerous game these days.

[Annie Minoff]

A French influencer named Kilian Desnos learned just how dangerous a few years ago.

[Sam Schechner]

Cillian Desnose, who is known online as Twiffer. He was a, you know, YouTube and Twitch streamer. Tuffer was well known for his crypto holdings.

[Annie Minoff]

In August of 2023, two people kidnapped Desnos father from his house in France. One of them was dressed as an Amazon delivery driver. They sent Desnos a ransom video showing his father bound with a gun to his head. Desnos paid the ransom and his father was freed. And this is because Tuffer was a little bit braggy online about his crypto wealth. Is that.

[Sam Schechner]

Well, you know, that certainly seems to be. Be the case and indeed tougher. You know, said that he sort of blamed himself. You know, he said on X that maybe, maybe he. He should have been more secretive. And after the recent kidnapping attempt in Paris, he wrote again on X that these kidnappings remind him of what happened to his family.

[Annie Minoff]

Yeah.

[Sam Schechner]

And that he actually got out of crypto.

[Annie Minoff]

At least two people were later arrested and faced preliminary charges in the case. Another group that's been targeted in wrench attacks are crypto entrepreneurs and executives known to have crypto wealth. And the pool of victims comes from around the world. Last July, an Australian crypto billionaire narrowly escaped abduction in Estonia. In March, a Houston crypto influencer's husband got into a shootout with home invaders demanding her laptop. And just last month, there was a big case in New York City. Police made a second arrest in an alleged cryptocurrency kidnapping scheme. In New York City, two men allegedly tortured an Italian man for weeks in an apartment to try to get at his crypto. And then there was a case earlier this year that shocked the crypto world before it ended. Somebody would be missing a finger. That's next. It happened sometime before sunrise in central France.

[Sam Schechner]

David Bellon and his partner were kidnapped brutally at gunpoint. They were separated, put in different vehicles, and driven Off.

[Annie Minoff]

David Balon is one of France's crypto elite. He helped found a crypto company called Ledger. Within hours of the abduction, other Ledger co founders had heard from one of the kidnappers. He wanted a ransom of 10 million euros to be paid in a cryptocurrency called Tether. And his messages made it clear that he wasn't messing around.

[Sam Schechner]

Very quickly they escalated to the point of showing a video of Balon as his finger was cut off.

[Annie Minoff]

Oh my gosh.

[Sam Schechner]

He had his pinky finger severed by one of the assailants. And you know, others showed him in emotional distress, what looked like a gun to his head.

[Annie Minoff]

Balon's friends, his co founders went to the police and together they'd embark on a multi pronged strategy. Part one was to start paying some of the ransom to buy police time to find Balon and his partner. And part two involved trying to get those ransom payments back.

[Sam Schechner]

They had connections to kind of get directly to Tether and to some of the exchanges that were involved so that they could get the cryptocurrency back as soon as the hostages were freed.

[Annie Minoff]

The idea was that as soon as Balon and his partner were safe, the co founder's contacts would pull back the ransom payments and recover the money.

[Sam Schechner]

And that meant that they basically had to stay on a vigil because they didn't know when they would be freed. And so you had some of the people, you know, on this team to claw back the ransom who were up 247 and you know, there was always somebody on duty waiting for the call and they were following in in real time as police raided one house. Nope, he's not there. Another house. Nope, he's not there. And then finally.

[Annie Minoff]

Police raided a farmhouse in the French countryside and they found Balon.

[Sam Schechner]

David is freed and they're almost ready to push the button basically and make the call to claw back the crypto. And then it turns out that the partner's not there.

[Annie Minoff]

They'd have to wait until Balon's partner was found to claw back the ransom. But they didn't wait long. They made another ransom payment and she was discovered the following day in a van at a roadstop an hour and a half north of the farmhouse where police had found Balon.

[Sam Schechner]

She was shaken, but okay. And so that story had a happy ending, but, you know, with the caveat that it was a pretty harrowing experience for both of them. Of course, Daveed was one finger short and he actually later, later posted to social media on his profile that, you know, it was like the, he wrote, like kidnapping championship. 20, 25 fingers, 9 out of 10 in total.

[Annie Minoff]

Balon's friends clawed back most of the 3 million euros in crypto that they'd sent as a ransom. It's interesting that the ability to transfer huge amounts of money instantly with crypto kind of facilitates this kind of crime. It makes it attractive. At the same time, in this case, the crypto was able to be clawed back almost just as instantly.

[Sam Schechner]

Yeah, it is an interesting duality. I think a lot of criminals and people in the world in general think crypto is anonymous and crypto is, you know, suited to crime. But in fact, in a lot of cryptocurrencies, every transaction is public. And so that actually makes it really a treasure trove of information for investigators. And it, it does make it a little bit more difficult to, to launder that money once it's stolen.

[Annie Minoff]

Did the attackers get away with it? Are they still at large?

[Sam Schechner]

Well, when they freed Bellon, they arrested a bunch of people and another 25 people were arrested in recent days of them were charged as, you know, linked to more recent kidnappings and others. So the question is, are they the organizers or are they just, as they'd say in French, petit main, little, you know, helpers. And it does seem that most of them are young, some of them are minors, they're recruited online. They don't actually know the entirety of the scheme.

[Annie Minoff]

They're just hired guns.

[Sam Schechner]

Yeah, they're hired guns. And unfortunately it means that the people who are profiting from the crime may still be at large.

[Annie Minoff]

A few weeks ago, Moroccan Authorities arrested a 24 year old French man who they suspect was a ringleader in some of the recent abductions.

[Sam Schechner]

The theory among investigators in France is that these cases are linked. One of the people who was actually arrested in the Killian Desnos case is suspected to have actually been in contact while in prison with the kidnappers in the Ballon case.

[Annie Minoff]

And interesting.

[Sam Schechner]

Okay, then the question is, is that person is that guy who himself is pretty young, in his 20s, was he the one who was in charge or is he also a hired hand?

[Annie Minoff]

Despite these recent arrests, the risk of wrench attacks seems to be growing. That's because people who own crypto are increasingly seeing their personal information leaked online. A few years ago, Ledger, the crypto company Bellon co founded, had one of its databases hacked. Information for over 200,000 customers was made public. A person familiar with the Ledger breach said that Belen's home address wasn't included in that information. And earlier this year Coinbase, a major American crypto exchange, was also hacked.

[Sam Schechner]

Coinbase basically came out and said that as many as 97,000 customers had had their personal information stolen from them. And that included things balance snapshots.

[Annie Minoff]

So you know how much crypto they.

[Sam Schechner]

Have, how much crypto they have, which is basically the target on your back, but also their. Their addresses in some cases. And, you know, the company said that data had been likely stolen by a bribed contractor or possibly employees who are working customer support.

[Annie Minoff]

So this is information that says, here's exactly how much crypto these people have, here's how rich they are, here's where to find them.

[Sam Schechner]

Exactly. In some cases, at least, that's the information that was hacked.

[Annie Minoff]

Coinbase said it's working with law enforcement to investigate the incident and is taking other measures to harden its defenses. What do these wrench attacks say to you about kind of the moment we're in with crypto?

[Sam Schechner]

That's a good question. What do they say to me about the moment we're in with crypto? It shows how crypto is becoming that much more important and mainstream. The value of assets in crypto has grown significantly. It's become a magnet for criminals, and yet at the same time, more and more people are holding it, which creates a wealth of new targets. It's also a sign that perhaps it's still a somewhat immature ecosystem. One of the things that's most attractive about crypto is that it does not rely on the traditional banking system, and it allows you to basically conduct transactions with people you don't trust without having to rely on a trusted third party, that you can live your life without the need for some central authority. And the question is, you know, how much that vision of a distributed world coincides with the sort of security that we expect today.

[Annie Minoff]

That's all for today. Friday, June 20th. The Journal is a co production of Spotify and the Wall Street Journal. Additional reporting in this episode by Angus Barrick and Bob McMillan. The show is made by Katherine Brewer, Pia Gadkari, Carlos Garcia, Rachel Humphries, Sophie Kodner, Ryan Knudson, Matt Kwong, Colin McNulty, Jessica Mendoza, Laura Morris, Enrique Perez de la Rosa, Sarah Platt, Allen Rodriguez Espinosa, Heather Rogers, Piers Singhi, Jeevika Verma, Lisa Wang, Catherine Whalen, Tatiana Zemis and me, Annie Minoff. Our engineers are Griffin Tanner, Nathan Singapak and Peter Leonard. Our theme music is by so Wiley. Additional music this week from Marcus Bagala, Peter Leonard, Bobby Lord, Emma Munger, Nathan Singapak and Griffin Tanner. Fact checking by Mary Mathis, Jennifer Goran, and Kate Gallagher. Thanks for listening. See you on Monday.