David Balland: The Ledger Kidnapping That Shook France

In the early hours of 21 January 2025, a group of men took David Balland and his partner from their home in Méreau, a village near Vierzon in the Cher, central France. Balland was one of the founders of Ledger, the French company whose small hardware wallets are used by millions of people to keep their crypto safe. Within hours another Ledger co-founder, Eric Larchevêque, received a video. It showed Balland's mutilated hand, with a finger cut off, and came with a ransom demand to be paid in cryptocurrency. Le Parisien and France 3 reported that the kidnappers wanted 10 million euros.

Larchevêque called the police. The Paris prosecutor's office took over the case, and by the next day France's elite gendarmerie unit, the GIGN, had found Balland held in a house in Châteauroux and freed him. He was taken to hospital. His partner was found on 23 January, tied up in the boot of a car in the Essonne, south of Paris. Both survived.

Why Balland was a target

Balland was no longer running Ledger day to day. Reports described him as a co-founder and former employee. But the company's name is known to anyone in crypto. A Ledger device is a small gadget, about the size of a USB stick, that stores the private keys to a person's crypto offline. A private key is the secret code that controls the coins; whoever holds it can move them. Keeping it on a device rather than on an exchange is the crypto version of moving shares out of a broker and into a safe at home.

That is also what makes crypto holders attractive to criminals. A bank transfer can be stopped and reversed. A crypto transfer, once made, usually cannot. Criminals call the approach a wrench attack, after the idea that the cheapest way to break strong encryption is to threaten the person who holds the key. The kidnappers did not need to hack anything. They needed a hostage and a way to be paid.

The money and the arrests

Part of the ransom was paid during negotiations run by the police, the Paris prosecutor, Laure Beccuau, said. Most of it was then traced and frozen. Crypto moves along a public ledger, so investigators could follow the payment from address to address.

Police arrested 10 people within days. On 25 January 2025 the prosecutor said six men and one woman had been placed under formal investigation, the French step closest to being charged, and held in custody. The offences included kidnapping and unlawful detention with acts of torture or barbarity and extortion by an organised gang, which can carry life sentences in France. No trial had been reported by October 2026, and all are presumed innocent.

One suspect escaped. He was traced across Spain, through the Valencia region, Seville and Cádiz, staying in flats rented online with someone else's bank card, according to Spain's Guardia Civil. He was arrested in Benalmádena, near Málaga, in March 2026 on a European arrest warrant issued by France.

The man accused of planning it

In June 2025 Moroccan police arrested Badiss Mohamed Amide Bajjou, a young French-Moroccan man, in Tangier on an Interpol red notice issued at France's request. French investigators suspected him of a central role in the Balland kidnapping and in other attacks on people linked to crypto. Morocco declined to extradite him because he is a Moroccan national, and tried him at home with evidence sent from France. On 21 May 2026 the Court of Appeal in Tangier sentenced him to 25 years in prison and ordered him to pay one million dirhams, about $110,000, to each victim, according to Moroccan and crypto press reports. The charges included forming a criminal organisation, kidnapping, detention and torture for ransom, and attempted murder. He denied them. Reports spell his name in several ways, and they do not make clear which individual cases the verdict covered.

What came after

The Balland case was the first of a run of attacks on crypto holders in France in 2025. In early May the father of a crypto entrepreneur was abducted in Paris; his kidnappers also cut off a finger before police freed him. On 13 May a gang tried to bundle the daughter and grandson of Pierre Noizat, chief executive of the French crypto exchange Paymium, into a van on a Paris street. She fought them off.

On 16 May 2025 the interior minister, Bruno Retailleau, met people from the industry and announced measures: priority access to the police emergency number, security briefings from elite police units and home security visits for the most exposed. Larchevêque said that was not enough and asked for the legal means for people to protect themselves.

The blockchain security firm CertiK counted 72 verified physical attacks on crypto holders worldwide in 2025, up 75% from 2024. France had 19, more than any other country. French prosecutors have since charged dozens of people across these cases, including minors.