Crypto kidnappings on the rise as criminals resort to “wrench attacks”

The recent case of an Italian tourist who was kidnapped in New York City and tortured by people allegedly after his cryptocurrency is drawing attention to a rash of crimes dubbed “wrench attacks,” which combine cybertheft with old-fashioned thuggery. 

The term stems from an XKCD comic that depicts a “crypto nerd’s imagination” of the tech know-how that would be required to break into their digital wallet. In reality, the comic notes, all it would take is a heavy $5 wrench to threaten the crypto owner until they revealed their account password.

Such attacks have picked up in recent months, partly because stealing a digital wallet can be easier than stealing money from a traditional bank account, said Ari Redbord, global head of policy and government affairs at TRM Labs, a crypto tracing firm. On top of that, the value of bitcoin has surged in recent months, making people with crypto holdings potentially lucrative targets for criminals. 

“Criminals go to where the money is, and we’re seeing a huge rise in the price of bitcoin,” Redbord said. “Before, you needed sophisticated cyber capabilities to hack someone, but now you can be a violent criminal who can beat [the password] out of someone.”

He added, “I don’t think I’ve ever been as taken aback by this type of illicit activity in crypto.”

The crypto world also has a culture of flaunting wealth via social media posts or appearances at crypto conference, which allows criminals to easily identify potential targets.

Bitcoin traded Friday at nearly $105,000 per token, according to CoinDesk — about 53% higher than a year ago. The digital currency has soared partly as people seek alternatives to put their money than traditional investments like stocks and bonds, and as the Trump administration takes steps to promote the use of cryptocurrencies, including establishing a “strategic crypto reserve.”

How to crack a wallet

Cryptocurrency thefts aren’t new, but they’ve typically involved hacking, such as a massive 2022 hack at crypto exchange Binance in which thieves initially stole $570 million, as well as multiple hacks by entities the United Nations found were linked to North Korea.

In response to such threats, crypto owners often try and keep their private keys off the internet and stored in what are called “cold wallets.” When used properly, such wallets can defeat even the most sophisticated and determined hackers.

But criminals have realized they don’t need any technical skills to steal crypto assets, Redbord said. All it takes is gaining access to a person’s crypto account password, because there’s no third-party financial institution standing in the way of accessing funds held in a digital wallet, he explained. 

Transactions on the blockchain, the technology that powers cryptocurrencies, are permanent. And unlike cash, jewelry, gold or other items of value, thieves don’t need to carry around stolen crypto. With a few clicks, huge amounts of wealth can be transferred from one address to another.

NYC crypto kidnapping

The case in New York City is somewhat unusual because it involves crypto investors allegedly trying to steal the assets of another investor, Redbord said.

In that case, investors John Woeltz, 37, and William Duplessie, 33, face charges of kidnapping, assault and unlawful imprisonment of the Italian tourist in an effort to steal his digital wallet containing bitcoin worth millions of dollars. Court papers allege that the pair held the unidentified 28-year-old victim for weeks in an apartment in New York City’s fashionable Soho neighborhood. 

After the victim was abducted, he was shocked with electric wires, his leg was cut with a saw and he was forced to smoke crack cocaine, prosecutors allege. Items including a photo of a gun held to the Italian tourist’s head were found in the apartment by investigators. 

Two New York City police detectives had been working security for the accused kidnappers, CBS News New York has reported. The detective have been placed on desk duty as police investigate.

Such incidents have also occurred with increasing frequency in Europe and Asia. Several cases in France have mirrored the New York City attack, with French police arresting 20 people following several alleged kidnapping plots involving crypto investors and their families, the BBC reported earlier this week. 

In one case, a gang allegedly tried to kidnap the daughter and young grandson of a cryptocurrency company executive in Paris, while earlier this month the father of a crypto millionaire was rescued by police in Paris after he was kidnapped and held for ransom. 

Aside from keeping a lower profile, crypto investors can take other steps to make it tougher for criminals, Redbord said. One option is to require permissions from several people to access a wallet, for instance. 

In the meantime, criminals are taking note and may be pursuing similar crimes, he added. “They are seeing successes and trying to replicate these successes,” Redbord said.

The Associated Press

contributed to this report.