Onchain Capital, Offchain Risk: How Crypto Became a Major Target for Kidnappers

Over the last few years, there has been a sharp increase in the number of reported attacks, kidnappings, and extortions faced by crypto holders. In the first four months of 2026 alone, criminals have physically coerced over $100 million in crypto from their victims across 34 verified incidents (CertiK). This represents a 41% increase over the same time period in 2025 and puts the industry on pace to exceed well over 100 attacks this year.

What was once a security edge case for most crypto holders has become a real concern. 

How Do the Criminals Operate?

As the promise of bigger payouts increased, crypto attracted a more polished type of K&R criminal. Instead of opportunistic crimes, now many attacks are orchestrated by professionals who use a data-driven approach. They learn everything they can about their victims by purchasing information from online brokers - both on the normal and dark web - giving them full insight into names, addresses, and more. 

The criminal operations also identify targets through company filings, conference appearances, LinkedIn profiles, and publicly available or leaked data. There have even been cases of otherwise anonymous holders being unmasked and attacked.

Many of these operators are based internationally and recruit local criminals to implement the physical part of the plan, employing real-world surveillance to learn the victim’s habits and ultimately undertaking the attack. Instead of wearing a simple mask, oftentimes the attackers impersonate law enforcement, delivery drivers, or other commonly-seen workers to spring their ambush.

Where Is It Happening?

This is an international issue, with attacks spanning France, Belgium, Spain, Turkey, Malaysia, Canada, Hong Kong, the Philippines, and the United States so far in 2026 (Lopp). 

France has become the epicenter for this sort of crime. Of the documented incidents this year, over 70% have occurred on French soil, already surpassing last year’s total count of French incidents. Even with high-profile kidnappings like that of Ledger co-founder David Balland and his wife - a case that ended in rescue after the elite GIGN tactical unit intervened - France has continued to be a hotspot for crypto-related K&R. A combination of data leaks and increased crypto transaction reporting requirements have provided criminals with a wealth of information on holders in France.

Who Is Targeted?

While criminals used to focus directly on the crypto holders, a worrying new trend has emerged. More than half of this year's documented incidents involve a family member - a spouse, child, or parent - either as the direct victim or a way to exert leverage. 

As wealthy individuals have increased their personal security, attackers realized that the easiest route to a crypto transfer may be indirect.

How Can Investors & Builders Stay Safe?

While the crypto industry has worked to increase its onchain security, it has been slow to address physical security risks. Securing a wallet doesn't secure the person holding it, and the last few years have brought this concern to the forefront.

Fund managers, protocol founders, and exchange operators in particular face increased risk of being personally identified and targeted. These leaders are often named in company filings, quoted by the press, presenting at conferences, and active on social platforms. Combined with large headline AUM or TVL numbers, success in crypto comes with added personal risk.

Crypto Kidnap & Ransom Cover

Conventional kidnap & ransom insurance was not designed for the unique risks that crypto holders face. That’s why Nexus Mutual launched Crypto Kidnap & Ransom Cover alongside crisis response firm Merrill Herzog and specialist underwriters InShare and Samphire Risk. 

This cover is more than just reimbursing a ransom: it gives crypto investors and executives 24/7 access to a global response team of former special forces and intelligence operators. With deep experience in extracting people from dangerous situations and a worldwide network of local professionals, Merrill Herzog are the sort of experts you want overseeing your safety.

Cover can extend to spouses, children, and other close family members, and confidentiality is built into the structure. No publicly available information connects the cover to any individual.

"Some products you buy and hope you never have to use," said Hugh Karp, Founder of Nexus Mutual. "With the recent increase in crypto-targeted kidnappings, we had to act. By teaming up with Merrill Herzog, InShare, and Samphire, we're able to provide a world-class security solution to address this."

"Our solution brings together alternative capacity, specialist underwriting and proven crisis response capability to deliver a world first in K&R protection that is credible, discreet and fit for the realities of the crypto world," said Graeme Thurgood, Chief Underwriting Officer at InShare.

To request a confidential quote for Crypto Kidnap & Ransom Cover, contact the Nexus Mutual team today.

If you have other questions about Crypto K&R Cover, see the FAQs here.