Loading story…
Cybercriminals in Europe are increasingly resorting to physical violence, including kidnappings and assaults, to extort cryptocurrency and privileged access from victims. According to CrowdStrike's European Threat Landscape Report and corroborated by multiple security researchers, at least 17 to 18 such incidents have been reported since early 2025, with France experiencing the majority of cases. Notable attacks include the January kidnapping and mutilation of Ledger co-founder David Balland and his wife, as well as a series of violent robberies targeting individuals known to possess significant cryptocurrency assets. Law enforcement has made several arrests, including the alleged ringleader in Morocco, but the threat persists and is evolving.
Experts note that these attacks often combine cyber and physical tactics, with criminals using cyberattacks as distractions or to identify high-value targets before launching in-person assaults. The rise of "violence as a service" is forcing organizations and individuals, especially those in the cryptocurrency sector, to reevaluate their security strategies and consider physical protection alongside traditional cyber defenses. Security consultants warn that playbooks for incident response must now account for the possibility of real-world violence accompanying digital threats, marking a significant escalation in the risk landscape for privileged users and executives in Europe.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
CrowdStrike released its European Threat Landscape Report, linking some violent cybercrime activity to 'The Com' and overlap with actors believed to be part of Scattered Spider. The report also assessed the UK as the most targeted European country based on organizations appearing on data leak sites and discussed the role of initial access brokers such as Hook Spider.
CrowdStrike cited unconfirmed intelligence that members of Scattered Spider discussed recruiting Com associates to physically visit a UK corporate headquarters, join onsite Wi‑Fi with a burner laptop, and enable RDP for remote access. The report presented this as an example of cybercriminals considering physical-world tactics to support intrusions.
One of the violent cryptocurrency-related crimes highlighted in CrowdStrike’s report was the kidnapping of Ledger co-founder David Balland and his wife in France. The incident was cited as part of a broader rise in cybercrime-linked physical violence in Europe.
Since the start of 2025, CrowdStrike identified at least 18 European cybercrime incidents involving real-world violence, with France accounting for a large share. The activity was described as a growing 'violence as a service' trend tied to cybercriminal ecosystems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Violent **"wrench" attacks** targeting cryptocurrency holders are increasing, with criminals using kidnapping, home invasions, and threats against family members or associates to force victims to surrender wallet access or transfer digital assets. According to reporting citing CertiK, **52 such attacks** were identified globally in the first half of 2026, up from **39** in the same period of 2025, while associated losses rose to **$124 million** from **$10.5 million**. Researchers and investigators say the attacks increasingly exploit the realities of **self-custody**, where victims can be coerced into authorizing irreversible transfers without any intermediary able to freeze or reverse the theft. U.S. prosecutors highlighted the trend in a Minnesota case in which brothers **Isiah Angelo Garcia** and **Raymond Christian Garcia** pleaded guilty after an armed 2025 home invasion that stole more than **$8 million** in cryptocurrency. Court documents said the pair traveled from Texas, held a family at gunpoint for more than eight hours, forced the primary victim to provide access to crypto accounts and storage devices, and fled before being identified through evidence left at the scene and arrested near Houston. The case has been cited alongside other incidents, including attacks in France and Connecticut, as part of a broader rise in crypto-related violent crime aimed not only at asset holders but also at spouses, children, employees, drivers, assistants, and friends.
Jul 24, 2026
Multiple law-enforcement actions were reported across Europe and the U.S. targeting **cyber-enabled criminal activity**, including online intimidation, financial malware operations, and crypto/NFT theft. In Hungary, police working with Romanian authorities detained four young suspects accused of **swatting** and **doxing** tied to disputes initiated via *Discord*, including false bomb and violence threats that triggered significant emergency response deployments. Separately, U.S. authorities convicted two Venezuelan nationals for a multi-state **ATM jackpotting** operation in which they physically accessed older ATMs, connected a laptop, and deployed **malware** to force cash dispensing, resulting in hundreds of thousands of dollars in losses and restitution orders. In Romania, two suspects were investigated at the request of UK authorities over an alleged **hitman-for-hire** marketplace designed to conceal identities and payments via **cryptocurrency escrow**, with police seizing storage devices, crypto valued around **$650,000**, and significant cash. In the Netherlands, Zeeland police arrested four suspects linked to the theft of **169 NFTs** valued at roughly **€1.4 million**, seizing data carriers, cash, vehicles, and a house during raids as the investigation continued.
Jun 29, 2026
European organizations are facing a surge in ransomware and data extortion attacks, with financially motivated eCrime groups and nation-state actors intensifying their operations across the region. According to CrowdStrike, nearly 22% of global victims named on dedicated leak sites are based in Europe, with the United Kingdom, Germany, Italy, France, and Spain being the most targeted countries. Key sectors under attack include manufacturing, professional services, technology, industrials, engineering, and retail. The rise in big game hunting (BGH) activity is attributed to the high value of European companies, political motives, and adversaries' adaptation to legal pressures such as the EU’s General Data Protection Regulation (GDPR). Recent high-profile incidents underscore the universal nature of cyber risk, affecting organizations of all sizes and sectors. Notable breaches include attacks on Marks & Spencer, Jaguar Land Rover, the British Library, Royal Mail, British Airways, easyJet, and several major European airports, the latter resulting from a compromise of a third-party service provider. These events highlight the interconnectedness of modern operations and the cascading impact of supply chain vulnerabilities. The evolving threat landscape demonstrates that no business is immune, and organizations must prioritize proactive cybersecurity measures to mitigate the growing risk of ransomware and extortion campaigns.
Jun 29, 2026