Ukrainian Police Officers Allegedly Kidnapped Crypto Entrepreneurs to Extort Millions

Former Ukrainian police colonels allegedly turned their law-enforcement expertise into a criminal enterprise, kidnapping crypto entrepreneurs and extorting over $2.2 million in a series of crypto “wrench attacks,” according to prosecutors.

The Kyiv Regional Prosecutor’s Office said Thursday it had completed its pre-trial investigation into a group that included four former police officers and a previously convicted civilian, all of whom have yet to be formally charged over the attacks.

According to prosecutors, the suspects were active officers of the Main Police Department in the Autonomous Republic of Crimea and Sevastopol, Ukrainian territory that has been under Russian occupation since 2014, as well as a Kyiv-based unit, before being discharged following their arrest.

Two colonels among them organized the group, recruiting fellow officers and a civilian accomplice with a prior criminal conviction.

Prosecutors accuse the defendants of creating and participating in an armed gang, kidnapping, unlawful imprisonment, robbery, extortion, and illegal possession of drugs.

The officials identified at least four crypto entrepreneurs as victims who were allegedly tracked, kidnapped, held at gunpoint, and forced to surrender money and sign documents acknowledging non-existent debts.

The gang reportedly used official skills, connections, and resources to operate in a coordinated manner with a clear division of roles, communicating through encrypted messengers, using official transport, and presenting themselves as law enforcement officers while committing the crimes.

In one documented case, a victim in Kyiv was allegedly abducted at gunpoint and forced to draw up a fake “debt” of $5 million before being moved between multiple undisclosed locations.

The gang’s illegal activities were terminated in November 2025, and all participants were released from the police service, with the case materials forwarded to the court.

Risk for crypto entrepreneurs

Law enforcement credentials have been used in crypto “wrench attacks” before.

In March, a Los Angeles Superior Court jury convicted former LAPD officer Eric Halem of kidnapping and robbery after he and accomplices posed as police to enter a Koreatown apartment, handcuffed two victims, and transferred $350,000 in Bitcoin from a 17-year-old’s crypto account.

The same month, a Versailles home invasion saw attackers pose as police and force a couple in their late 50s to transfer roughly $1 million in Bitcoin at knifepoint.

Cases where institutional authority is abused to coerce crypto holders remain unusual, cybercrime consultant David Sehyeon Baek told Decrypt.

“The victims’ crypto may have been cryptographically secure, but that did not matter once violence, coercion, and forced agreements entered the picture,” he added.

Crypto creates a distinct security risk because assets can be transferred “quickly, across borders, and under duress,” he said, adding once local protection becomes unreliable, entrepreneurs need to treat personal security, jurisdictional risk, legal backup, and operational secrecy as seriously as wallet security.

The case, Baek said, illustrates how crypto entrepreneurs can become targets not just for hackers but for actors capable of exploiting official power, warning that in high-corruption environments extortion can resemble “a distorted abuse of state authority” rather than ordinary street crime.

War, corruption, and institutional stress can create conditions in which coercive schemes are harder to detect, he noted, giving criminals more room to operate behind what he called “confusion, fear, and fake legal pressure.”

72 verified “wrench attack” incidents occurred globally in 2025, a 75% jump from the prior year, with confirmed losses exceeding $40.9 million, according to a report from blockchain security firm CertiK.

In France, authorities charged 88 suspects, more than 10 of them minors, in judicial investigations into violent crypto kidnappings in late April, after recording 135 crypto-linked incidents since 2023.

The most recent high-profile case came earlier this month, when six suspects, two of them teenagers, allegedly attempted to kidnap Sandbox co-founder Sébastien Borget’s wife at their French home.