A crypto-related attack can target more than a wallet. Criminals may exploit leaked personal information to identify holders, use phishing or impersonation to steal account access, or threaten someone in person to force a transfer. In France, reported incidents have included assaults, kidnappings and extortion. Figures published by Cryptoast on October 9, 2026, counted 32 cases since the start of the year, compared with 19 for all of 2025; the Interior Minister separately reported 77 crypto-related incidents involving kidnapping, confinement or extortion during the first half of 2026, including attempted offences. These figures use different reporting methods, but both point to a serious and evolving threat.
If you are targeted, focus first on what can still be protected. During a physical assault, your safety matters more than your assets; after you are safe, preserve evidence, report the incident and secure any accounts or devices that may have been exposed. Blockchain transactions can sometimes be traced, and investigators may be able to seek information or a freeze when funds reach an identifiable platform, but recovery is never guaranteed. A clear plan can reduce panic and help you make safer decisions—whether the threat is a message on your phone or an attacker at your door.
In brief: Prioritize physical safety and contact emergency services when needed. Preserve messages and transaction details, report the attack promptly, then use a trusted device to secure compromised accounts and wallets. Treat unsolicited recovery offers as another possible scam.
What to do during a crypto-related attack
A crypto attack does not always begin online. Criminals may use personal-data leaks to connect a name with an address, then apply threats or physical force to demand access to funds. Reporting on cryptocurrency-related kidnappings in France describes how these crimes can put victims and their families under intense pressure.
If you are being physically threatened, protect your life and avoid confrontation. Do not take extra risks to hide a device, identify an assailant or protect a wallet. If it is safe to do so, contact emergency services as soon as you can; in France, call 112 or 17. The right response depends on the situation, so do not treat any financial tactic as a substitute for immediate safety.
Prepare for coercion without relying on a single tactic
Security professionals interviewed in the source reporting describe preparing in advance as one way some people reduce the pressure of a forced transfer. One approach is to keep a limited amount in a separate wallet that could be surrendered if necessary. This is not a universal recommendation or a guarantee of safety: attackers, circumstances and available options vary, and no one should try to improvise a transfer while in immediate danger.
For people with heightened exposure, discuss personal security planning with qualified professionals and trusted family members. A plan should prioritize getting help and should not reveal the location of other assets or create a false sense of protection. Preparation can support safer choices, but it cannot eliminate physical risk.
How to respond when a loved one is kidnapped
If a partner, relative or friend is taken, contact police or gendarmerie immediately and follow their instructions. Do not attempt a rescue, confront suspected kidnappers or make independent arrangements that could put the victim in greater danger. Keep communication open with the authorities and share any new demands or threats with them promptly.
Preserve messages, phone numbers, account names, voice messages and other communications from the kidnappers. Avoid deleting or editing them, and do not post sensitive details publicly; information shared online can reach criminals as well as investigators. The reported case of Ledger co-founder David Balland, who was rescued by the GIGN, illustrates why these situations require professional intervention. Further coverage of a crypto-related family kidnapping highlights the importance of treating threats to relatives as an emergency, not as a private negotiation.
For family members, rapid reporting and preserving evidence are safer than trying to solve the situation alone. Once authorities are involved, give them a clear timeline of events and identify which accounts or wallets may be at risk.
Crypto scam response: secure accounts after the immediate danger
When there is no immediate physical threat—or once you are safely away from one—move to digital containment. Use a trusted device that you believe has not been accessed by the attacker. Secure the email account linked to your exchange and wallet services first, because control of email can let criminals reset other passwords.
Start a password reset using official websites or apps, not links sent in suspicious messages. Choose unique passwords, sign out other sessions, remove unknown devices and revoke unfamiliar API keys or connected applications. Enable two-factor authentication or a passkey where available, and store recovery codes somewhere separate and secure. These steps strengthen account security, but they cannot make an exposed recovery phrase safe again.
If you entered credentials into a suspicious page or installed software at an attacker’s request, treat the device and accounts as potentially compromised. This is a common pattern in phishing and impersonation schemes. Contact the exchange or wallet provider through verified channels, explain what happened and ask what protective measures are available. Never share a seed phrase or private key with “support.”
Protect remaining funds only from a trusted environment
If a private key or recovery phrase was disclosed, assume that wallet can no longer be trusted. Once you are safe, create a new wallet with a fresh recovery phrase on a clean, trusted device and consider moving any remaining assets to it. Do not enter the old phrase into a website or send it to someone who claims they can secure the funds for you.
Where an exchange account may be involved, ask the provider to restrict withdrawals or freeze access if it offers that option. A freeze may not be available in every case, especially for self-custody wallets, so act through official support channels and avoid rushing into transfers based on messages from strangers. Effective wallet protection starts with keeping recovery credentials private and separating them from everyday devices.
Breaches of personal information can also make targeted approaches more convincing. Coverage of data-breach-related extortion risks is a reminder to treat unexpected claims about your holdings or identity with caution. A caller who knows your name, balance or transaction history may still be an impostor.
Incident reporting and preserving crypto transaction evidence
After you are safe, record what happened as accurately as possible. Keep the recipient wallet address, transaction ID, amount, timestamp, blockchain network, screenshots and all relevant messages. Note the names of platforms involved and the devices or accounts that may have been accessed. Do not alter the original evidence; make copies and store them securely.
Report the incident to local law enforcement and, where applicable, to the exchange or service provider. This incident reporting gives investigators a timeline and may help them contact platforms quickly. If you are in France, report the matter to the police or gendarmerie and ask how to provide the transaction records and communications. A lawyer experienced in financial or criminal matters may help you understand next steps.
Public blockchains can make transaction activity visible, but visibility does not mean that funds can automatically be returned. Specialists may follow transfers and, if assets reach a centralized service, investigators may seek account information or request a freeze. Funds routed through multiple wallets, chains or jurisdictions can be harder to pursue. Asset recovery is possible in some cases, but it is uncertain and should never be promised.
Use transaction monitoring, but beware of recovery scams
After recording the original transaction details, monitor relevant wallet activity and official communications from any platform involved. That transaction monitoring may help you notice further unauthorized movements, but do not connect your wallet to unfamiliar “tracking” sites or share credentials with people offering to investigate.
People who have already lost funds are often targeted again by fake recovery experts who promise to retrieve crypto for an upfront fee. Avoid anyone demanding payment, a seed phrase or remote access to your computer. Check offers independently, and share evidence with law enforcement or a qualified professional instead of responding to unsolicited direct messages.
Keep a concise timeline: when the first contact occurred, what was demanded, what you shared or transferred, and which authorities or services you contacted. Clear records make it easier for investigators and providers to understand the incident—and help you take the next step without giving criminals another opening.
