Last week North Korea pulled off the biggest heist in history when state-sanctioned hackers stole $6.3 billion from the Binance cryptocurrency exchange. About half of the assets made their way into Pyongyang’s coffers. As the world’s largest exchange, Binance said it would cover its customers’ losses, but the hack still spooked many crypto traders, who are notoriously jumpy. They withdrew $3.6 billion on Sunday.
The paranoia around holding cryptocurrency is well founded. In essence, they are just digital currencies which are incredibly hard to trace. You can follow the transactions, but you don’t know the identity of who owns them. Funds can be moved around multiple times a minute and easily swapped between different currencies, all with no checks. If you have the encryption keys to a crypto wallet, you have complete ownership of its funds. If you lose access, you can’t get them back. Crypto’s zero-sum game has made it more lucrative to international gangs and rogue states – and increasingly they are willing to be violent to get it.
In December, three men barged into a family home in a Solihull suburb, beat a man with hammers and threatened to stab his pregnant wife in the stomach unless he transferred money to his attackers. Normally, assailants like these would be opportunistic thugs hoping for a lucky haul and their efforts would probably be thwarted by a bank reversing the transfer of funds. But this was a targeted raid to steal hundreds of thousands of pounds’ worth of cryptocurrency. Ten months after the Solihull attack, there is still no information about the attackers. Like the money, they just disappeared.
The anonymity of crypto is why these violent robberies, known as ‘wrench attacks’, are so effective. The term comes from an old internet joke about hacking: ‘Why would I need a multimillion-dollar hack when I can hit the target with this $5 wrench?’ The logic of that joke is what scares crypto traders. The North Koreans can pick your pocket using sophisticated hacking, but a local thug will beat you with a wrench until you pay up.
There have been at least 37 wrench attacks in Britain, each netting the attackers an average of $700,000. Last month, a UK-based crypto influencer was held at knifepoint in his own home and forced to transfer $800,000 to his attackers. He no longer considers Britain a safe place in which to trade crypto: ‘If you live in the UK and do crypto, get the fuck out.’ Other traders are just as tetchy. One experienced trader told me that ‘many of the crypto people [they] knew have left for Dubai’. Traders in other countries are nervous too. The US has had a spate of crypto attacks so far this year. In France, wrench attacks are endemic. Officials have counted 90 kidnappings, extortions and violent robberies this year – more than one every three days. Total losses amount to $124 million.
Last year the co-founder of the billion-dollar crypto firm Ledger, David Balland, was kidnapped. The attackers cut off Balland’s finger and demanded $11 million before police managed to free him. In another high-profile case, two crypto millionaires who flaunted their wealth on social media were grabbed while holidaying in London and tortured for two days before paying for their release.
Those who keep a low profile aren’t safe either, as tax leaks and data breaches put anyone who has invested at risk. The trader who was robbed of $800,000 last month suspects that his personal information was made available to criminals by a data breach at his bank. Last year, a French tax official was arrested for selling the details of crypto investors to criminals, which led to a spate of wrench attacks.
Since January, the EU has required mandatory transaction collection by crypto trading platforms, leading to more personal details being stored for tax purposes. Then, in June, a data breach at the French tax authority exposed the personal and financial records of 678,000 people, leading to even more attacks. Britain has also introduced ‘Know Your Customer’ regulations surrounding crypto, which record names and addresses. The problem with the checks, one trader tells me, is that ‘all criminals successfully circumvent it with stolen IDs’, so the system protects criminals and exposes honest actors with every leak. ‘It’s becoming known as Kill Your Customer,’ they say.
Around 60 per cent of wrench attacks in London involved a kidnapping. In France, around two in five of those attacked were relatives of the target. In April, a mother and son were kidnapped in Burgundy for a crypto ransom. In May, six men tried to abduct the wife of a tech firm founder near Paris. As the threat to relatives rises, traders are increasingly paranoid. ‘The choice really is, do I dodge tax and keep all my info private, or do I tell the truth and get robbed?’ says one.
‘The choice really is, do I dodge tax and keep all my info private, or do I tell the truth and get robbed?’
Even handing over your assets is no guarantee of release. Last November, two Ukrainian men were arrested in connection with a wrench attack in Vienna. The victim’s teeth were knocked out, and he choked to death on his own blood after giving up his encryption keys. His body was found in the back of his Mercedes. Around 26 people have died in crypto-linked attacks, according to the security business Gart.
The law’s response to wrench attacks is slowly improving. French police managed to charge 88 suspects by April, while the Metropolitan Police has a 40-strong team specialising in crypto crimes. The Met tracked and arrested three Sheffield teenagers who stole $4.3 million from a trader in Hackney and recover the funds. The police were lucky that the attackers fled in the victim’s car and were posting about their crimes on social media. The speed of police response is crucial to having any chance of recovering the money, and the Met acknowledges that the chance of ‘asset recovery’ is ‘typically minutes to hours’. When the money is recovered, a trader tells me, it’s because ‘we are lucky that some criminals are so shit’ because ‘if you know what you’re doing, you can disappear the funds instantly’. In March, $24 million from a single attack in Britain was routed multiple times before being transferred into another cryptocurrency that specialises in privacy, Monero, after which the funds could not be traced.
The proceeds of wrench attacks filter into the world of organised crime. Attackers are often local thugs recruited by an anonymous third party. In the Solihull attack, the victim said the attackers had little understanding of how to access the money and were taking instructions from someone else on a video call. ‘You can have ten grand each, but I am taking the rest,’ said the voice on the phone. Most law enforcement officials acknowledge there is a lot of planning in these attacks, with masterminds often ‘based abroad’, according to France’s judicial police.
Traders and investors used to prize crypto for its security and anonymity. Increasingly, however, that’s no longer the case.
Comments