Man indicted in Nancy over alleged crypto wrench attack

A 32-year-old man from Vaujours has been indicted in Nancy on charges of attempted extortion with a weapon, attempted kidnapping by an organized gang and conspiracy to commit a crime. Prosecutors allege he was one of three men who posed as police officers and attacked a couple to force the transfer of cryptocurrency.

The assault followed a January data breach at crypto tax platform Waltio that exposed email addresses, 2024 trading gains and losses, and balances for about 50,000 users. Prosecutors allege the attackers used personal information from the leaked files to identify a target holding roughly €20,000 in crypto.

Witnesses reported a 45-year-old woman was accosted outside her apartment and her husband came outside to investigate a disturbance. Both were beaten before the intruders fled after the couple’s daughters called police from inside the home. Officers later recovered plastic zip ties and a €5 note at the scene. Witnesses described one assailant as armed with a weapon resembling an Uzi-style submachine gun.

Waltio said stolen data was offered for sale after the breach and warned customers that attackers could pose as customer support, police or security services, using known email addresses and estimates of assets to gain credibility.

French authorities have recorded a rise in violent attacks targeting people known or believed to hold cryptocurrency. Recent incidents include the kidnapping and mutilation of a crypto entrepreneur, armed home invasions, a case in March in which three men posing as police reportedly forced a couple to transfer about €900,000 in Bitcoin, and numerous abduction attempts. In April, prosecutors charged 88 suspects, including minors, across 12 investigations linked to crypto-related kidnappings.

Interior minister Bruno Retailleau plans to meet cryptocurrency business leaders to discuss security measures. An industry executive criticized the authorities’ handling of the wave of attacks and used the term ‘Mexicanisation’ to describe the trend.

Phil Ariss, director of UK public sector relations at TRM Labs, described wrench attacks as an evolution of criminal tactics in which groups comfortable with violence target digital assets.

Investigators in Nancy say they are coordinating this case with other probes to identify networks that may be using leaked user data to plan and carry out targeted physical attacks on crypto holders.