France has become the global epicenter of physical attacks targeting cryptocurrency holders. Since early 2025, more than twenty cases of kidnappings, unlawful confinements, and violent assaults have been recorded on French territory, representing nearly 30% of all cases reported worldwide. As 2026 begins, the situation is only getting worse: 11 physical attacks were reported in France in just the first six weeks of the year, accounting for approximately 80% of all global incidents during that period.
The Balland Affair: The Beginning of a Dark Chapter
Everything changed on January 21, 2025. David Balland, co-founder of the renowned French company Ledger, and his partner were kidnapped from their home in Vierzon, in the Cher department, in the early hours of the morning. The kidnappers immediately separated the two victims and contacted Éric Larchevêque, another Ledger co-founder, demanding a ransom of 10 million euros in cryptocurrency. To maximize pressure, the kidnappers did not hesitate to mutilate David Balland’s hand, severing one of his fingers.
The national gendarmerie immediately deployed considerable resources: 50 soldiers from the Cher gendarmerie grouping, then 80 investigators in total. Within less than three days, both victims were found and ten criminals arrested. The investigation later identified the alleged mastermind: Badiss Mohamed Amide Bajjou, a 24-year-old Franco-Moroccan, arrested in Morocco in late June 2025 through international cooperation.
May 2025: The Darkest Month
May 2025 marked a peak of violence with at least four cases reported within just a few weeks:
- May 1st: The father of a crypto-millionaire (a former poker player turned crypto investor) is abducted in broad daylight in Paris. The kidnappers sever one of his fingers and demand between 5 and 7 million euros in ransom. The man is found 58 hours later after a race against the clock involving the most specialized units of the Parisian police.
- May 13th: A spectacular attempted kidnapping occurs in broad daylight in the 11th arrondissement of Paris. The target is the daughter of Pierre Noizat, CEO of the Paymium exchange platform, accompanied by her 2-year-old son. Four masked men jump out of a van, but the woman resists with the help of her husband and a neighbor armed with a fire extinguisher, forcing the attackers to flee.
- Mid-May: A kidnapping plot is foiled in Normandy and an attempt is aborted in Nantes, where police intercept about ten masked criminals with two vans.
Following these events, French authorities conducted major operations on May 26 and 27. In total, 25 people were indicted, including six minors. Suspects ranged from 16 to 23 years old and came from various backgrounds. Investigators believe these were « low-level operatives » recruited via social media for a few thousand euros by criminal organizations operating abroad.
The French Government’s Response
Retailleau’s Emergency Meeting
Faced with the scale of the phenomenon, Interior Minister Bruno Retailleau convened an emergency meeting on May 16, 2025, with crypto sector stakeholders, the Paris police prefect, directors of the police and gendarmerie, and the Association for the Development of Digital Assets (ADAN).
📋 Four Immediate Measures Announced:
- Priority access to emergency line 17 for crypto sector professionals
- Home security consultations by police and gendarmerie safety advisors
- Security briefings provided by elite units (GIGN, RAID, BRI) for the most exposed individuals and their families
- Dual contact points: emergency line 17 and the Cyberspace Command (ComCyberMI) for industry support
Severe Legal Penalties
The Interior Ministry emphasized that acts of kidnapping and unlawful confinement with mutilation to obtain ransom are punishable by 30 years of criminal imprisonment, with no possibility of sentence reduction, even when the victim is released before law enforcement intervention (Article 224-2 of the Penal Code).
The PNACO: A Structural Response in 2026
On January 5, 2026, a National Anti-Organized Crime Prosecutor’s Office (PNACO) was officially launched, led by magistrate Vanessa Perrée. Originally designed to combat drug trafficking, this new specialized prosecution office immediately took up « crypto kidnapping » cases. In its first weeks of existence, it assumed oversight of at least four kidnapping cases linked to cryptocurrencies. The PNACO has 16 magistrates handling 170 cases in total.
2026: The Alarming Acceleration Continues
The first weeks of 2026 confirm a disturbing trend, with a series of serious incidents across France:
🗓️ December 2025 – Charente-Maritime
In Dompierre-sur-Mer, near La Rochelle, a couple is held captive and assaulted by three hooded individuals who force them to transfer €8 million in crypto assets. The man, who works in the cryptocurrency sector, is hospitalized. The investigation is handed to the Specialized Interregional Jurisdiction (JIRS) in Rennes.
🗓️ January 14-15, 2026 – Sallanches (Haute-Savoie)
A retired couple — she was a teacher, he a doctor — is kidnapped at their home in a hamlet near Sallanches. The kidnappers demand a ransom of €8 million in cryptocurrency from their son, who works in the sector. Videos of the abuse inflicted on the victims are sent to their son to speed up payment. The couple is found on January 16 in Montélimar, in the Drôme, seriously injured and hospitalized.
🗓️ January 25, 2026 – Voiron (Isère)
A 74-year-old man is abducted from his home by four individuals armed with knives and shotguns. The kidnappers demand €3 million in cryptocurrency from his son, who lives abroad. The BRI intervenes and frees the victim in Loriol, in the Drôme. Three suspects are arrested in Lyon, and a fourth is later apprehended.
🗓️ February 4-5, 2026 – Saint-Martin-le-Vinoux (Isère)
A 35-year-old magistrate and her 67-year-old mother are abducted from their home by a commando that breaks down the door in the middle of the night. The magistrate’s partner, director of a Lyon-based company specializing in Bitcoin, receives a photo of his partner accompanied by mutilation threats. The two women are held captive for 30 hours in a garage in Bourg-lès-Valence, in the Drôme, before managing to free themselves by taking advantage of their captors’ absence. Six suspects are arrested, including a minor.
🗓️ February 12, 2026 – Val-de-Marne (Attempted Attack on Binance France CEO)
David Prinçay, head of Binance’s French division (the world’s largest crypto platform), is targeted in a home-jacking attempt. Three hooded and armed men force their way into his residential building around 7 AM. Not finding Prinçay, the assailants search the empty apartment and leave with only two mobile phones. All three suspects are intercepted the same day at Lyon-Perrache train station thanks to surveillance cameras and geolocated phones.
The Role of Data Breaches: The Waltio Case
One of the aggravating factors in this wave of violence is the data breach at the crypto tax platform Waltio. More than 5,000 French cryptocurrency holders had their personal information exposed on the dark web since December 24, 2025, according to firm Brinztech.
Compromised data includes names, email addresses, phone numbers, and tax residency status. A hacker publicly claimed on the BreachForums forum that three kidnappings were directly linked to the exploitation of this database, for a total haul of $17.1 million.
The breach has been attributed to the ShinyHunters hacking group. Waltio only confirmed the incident on January 23, 2026, a full month after it went on sale on the dark web. The Paris prosecutor’s office opened a preliminary investigation assigned to the National Cybercrime Unit.
⚠️ The French government issued specific alerts warning that criminals might impersonate law enforcement officers to target victims of the data breach.
A Global Phenomenon, but France on the Front Line
According to data compiled by Jameson Lopp, chief security officer at Casa, physical attacks against cryptocurrency holders surged by 169% in 2025 compared to the previous year, with over 225 verified cases worldwide. In total, approximately 72 confirmed attacks were recorded globally in 2025, of which 19 occurred in France — more than double the number recorded in the United States.
According to blockchain security firm CertiK, France accounts for a disproportionate share of these incidents. Home invasions represent approximately 25% of cases, kidnappings 23%, and two-thirds of attacks succeed.
Why Is France So Targeted?
- Data breaches (Waltio, Ledger in 2020) provide criminals with target lists containing names, addresses, and estimated crypto holdings
- Recruitment of young attackers via social media, sometimes minors, paid as little as $10,000 by masterminds abroad
- The profile of masterminds often based outside France (Morocco, non-cooperative countries), making prosecution complex
- No definitive convictions to date, which may embolden new criminals
- DAC8 regulation, which since January 1, 2026 mandates disclosure of crypto investors’ personal data to European tax authorities, potentially increasing leak risks
Criminal Profile: Young, Recruited Online, but Organized
Investigations reveal a recurring modus operandi: masterminds are experienced criminals operating from abroad, while foot soldiers are young individuals, often aged 16 to 23, recruited via encrypted messaging apps. These « low-level operatives » carry out the abductions, surveillance, and logistics, while the ringleaders remain at a safe distance.
The methods have become increasingly professional: prior surveillance of victims and their families, use of abuse videos to speed up payment, and targeting « collateral » victims (parents, spouses, children) rather than the crypto holder themselves.
🛡️ How to Protect Yourself
In the face of this growing threat, security experts recommend several essential precautions:
- 🔇 Never publicly disclose your crypto holdings, especially on social media
- 🔐 Use multi-signature wallets with geographically separated signing keys
- 🛡️ Protect your personal data and be wary of platforms that centralize sensitive information
- 💼 Set up a « decoy wallet » with a limited amount to transfer under duress
- 📞 Contact law enforcement via the emergency line (17) or ComCyberMI if you suspect a threat
- 🎓 Take advantage of security briefings offered by GIGN, RAID, or BRI for sector professionals
« These challenges go beyond crypto assets. They concern all entrepreneurs, and more broadly, all French people fighting for their future. No one should have to hide or fear for their physical safety simply because they have succeeded. »
Éric Larchevêque, co-founder of Ledger
Conclusion
France faces an unprecedented security crisis in the cryptocurrency sector. Between massive data breaches, recruitment of young delinquents via social media, and elusive masterminds operating from abroad, the « crypto kidnapping » phenomenon has grown to a scale that now extends beyond digital finance to strike at the very heart of citizens’ physical security.
The creation of the PNACO, the Interior Ministry’s emergency measures, and strengthened international cooperation represent promising responses — but the absence of definitive convictions and the persistence of data leaks remain major challenges to be addressed. Individual vigilance, combined with a strong institutional response, is more essential than ever.
⚠️ Disclaimer: This article is published for informational and educational purposes only. It does not constitute financial, investment, or legal advice. The information presented is based on publicly available sources at the time of writing. CryptoInfo.ch assumes no responsibility for decisions made based on this article.
