France sees rise in crypto kidnappings tied to data leaks

French police and cybercrime teams report a rise in kidnappings this year in which attackers use stolen personal data to target people with cryptocurrency holdings. Incidents have been recorded in Paris, Lyon and Marseille and are under active investigation.

Investigators say gangs assemble personal details from data breaches, social media and commercial brokers to identify targets and map daily routines. Collected items include home addresses, relatives’ names, travel schedules and online posts that indicate crypto ownership. The data is sold or shared on encrypted messaging platforms, according to law enforcement.

After gathering intelligence, operatives follow targets in public or approach them at home. Attackers have used threats, restraints and displays of force to coerce victims into transferring funds or revealing wallet keys. Payments are commonly requested in Bitcoin or privacy-focused coins and are routed through mixing services or converted through intermediaries to hide their path.

A senior investigator involved in the cases noted, “A phone number here, a delivery address there, photos of a car — put together they let criminals find someone within hours.” Police reports describe teams that use lookouts and getaway drivers and often involve multiple attackers.

Prosecutors have opened inquiries in several jurisdictions. Cyber units are tracing on-chain flows to find ransom endpoints, but investigators face obstacles when funds move through chain-hopping, peer-to-peer exchanges and jurisdictions with weaker controls. Rapid movement of transfers increases the complexity and resource demands of tracing.

Victims identified so far include private investors and small business owners who accept crypto payments or display assets publicly. In multiple cases attackers contacted or abducted family members to increase pressure, a tactic linked to access to victims’ contact lists and personal networks.

Financial crime prosecutors, banking regulators and cryptocurrency firms have begun sharing alerts and monitoring suspicious on-chain activity tied to reported abductions. Authorities have issued guidance to crypto businesses and legal professionals to preserve records and report suspicious transfers quickly. Interior ministry officials reported increased patrols in affected neighbourhoods and called for cooperation with European partners to track cross-border money flows and suspects.

Wrench attacks refer to physical coercion used to force victims to disclose passwords or authorize transactions. Investigations in France remain active and law enforcement officials say outcomes will depend in part on improved data-sharing between police, crypto firms and financial intelligence units across borders.