France: 88 Indicted in the Wrench Attack Sweep

On the evening of 20 May 2026, a man dressed as a delivery driver rang at the gate of a house in Villenoy, east of Paris, holding a parcel. When the woman inside opened it, masked men pushed into the courtyard and tried to drag her to a waiting Citroën C3. Neighbours heard her screams and came running, and the attackers fled. Two of them hid nearby and then called a ride-hailing car; police from nearby Meaux stopped it. They were 14 and 15 years old. The woman is the wife of Sébastien Borget, co-founder of The Sandbox, a crypto video game.

A month earlier France's new national organised crime prosecutor, Vanessa Perrée, had stood up in Paris to explain why cases like this kept happening. On 24 April 2026 her office announced that 88 people had been charged across 12 investigations into crypto kidnappings and extortion. Seventy-five were being held in custody awaiting trial. More than ten were minors.

The numbers

French police counted 135 kidnappings and forced confinements linked to crypto between 2023 and April 2026: 18 in 2024, 67 in 2025 and 47 in the first four months of 2026. On 30 June the Interior Minister, Laurent Nuñez, told crypto industry representatives that the count for 2026 had reached 77 cases and that about 200 people had been arrested, some before they could act. Figures the ministry released in October, the first national count under a single definition, recorded 90 crypto-linked kidnappings, extortions, threats and violent robberies between January and mid-August, about one every two and a half days, with 223 arrests and 126 people jailed between January and July.

Security firm CertiK counts about four in five of the world's recorded attacks in Europe, and France is the worst-hit country by a distance.

What a wrench attack is

Crypto is protected by passwords and private keys, strings of characters that act as the only key to a digital safe. Breaking them by computer is close to impossible. Forcing the owner to hand them over is not. A well-known 2009 cartoon by the web comic xkcd made the point: instead of cracking the encryption, beat the owner with a $5 wrench until he gives up the password. The industry has called these crimes wrench attacks ever since.

What makes them work is that crypto held personally, in self-custody, has no bank in the middle. A transfer made at knifepoint cannot be stopped or reversed the next morning. Once the money moves, the attackers often convert it into Monero, a coin designed to hide who sent what to whom, which makes it very hard to follow.

How the gangs work

Prosecutors describe a two-level business. At the bottom are small crews of three to five, mostly young men, some of them teenagers, recruited through messaging apps such as Telegram and Snapchat. Teenagers are cheap and, under French law, face much lighter sentences than adults. Perrée told reporters that some of those charged appeared in several cases at once, evidence of "structured networks" rather than one-off thugs.

Above them sit the organisers, often abroad, who pick the targets and handle the money. The best known is Badiss Mohamed Amide Bajjou, a French-Moroccan prosecutors call the presumed mastermind of the first wave, including the January 2025 kidnapping of David Balland, co-founder of the French crypto wallet maker Ledger. Balland and his partner were taken from their home in the Cher region; his captors cut off one of his fingers and sent the images to another Ledger co-founder with a ransom demand. Police freed them within about two days. Bajjou was arrested in Tangier, Morocco, in June 2025 on an Interpol warrant. Because Morocco does not extradite its own nationals, he was tried there, and in May 2026 a court in Tangier sentenced him to 25 years for kidnapping, confinement, blackmail and money laundering. He denied everything.

Targets are increasingly chosen from data rather than by watching houses. Exchanges and tax services must collect customers' identity documents and addresses under "know your customer" rules, the same identity checks a bank or broker runs when an account is opened. When those records leak, a buyer gets a list of names, addresses and rough balances. In January 2026 the French crypto tax service Waltio reported that hackers had stolen data on tens of thousands of users, mainly 2024 tax reports showing email addresses, gains and holdings, and tried to extort the company. The government warned Waltio's users that they could face kidnapping or threats to their families. No court has yet tied a specific attack to that leak.

By one count published in October, more than 40% of French victims are not crypto holders at all but their relatives: a father, a wife, a daughter. In May 2025 a crypto entrepreneur's father was snatched in Paris and had a finger cut off before police rescued him, and the same month a gang tried to force the daughter of Pierre Noizat, head of the French exchange Paymium, into a van in broad daylight.

Will it hold

France has rebuilt its response around organised crime. The national prosecutor's office, PNACO, opened in January 2026 to take the most complex cases, and charging suspects as members of organised gangs rather than as individual robbers brings heavier sentences. In July the government announced a three-part plan with the crypto industry association ADAN: sharing intelligence on organisers abroad, linking crypto firms directly to police, and working faster with foreign governments. By then 724 people in the industry had signed up for a fast-response police identification scheme.

The courts are the bottleneck. As of mid-October 2026 none of the 88 people charged in April had been tried, and the nine people charged over the Balland kidnapping had no trial date. The first long sentence in the whole wave was handed down in Morocco, not France.