Crypto Kidnapping: Double Arrest in Spain and Sallanches
📋 En bref (TL;DR)
- Last fugitive arrested: the final suspect in the kidnapping of Ledger co-founder David Balland was apprehended in Benalmadena (Spain) after 14 months on the run
- Sallanches case: 7 suspects arrested on March 24 for the kidnapping of an elderly couple, targeted because of their son’s crypto holdings
- 8 million euro ransom demanded in the Sallanches case, finger amputated in the Ledger case
- 1 assault every 5 days in France in 2026 — the country accounts for 80% of European crypto kidnappings
- Family targeting: criminals now target relatives (parents, spouses) rather than the crypto holders themselves
- 2020 Ledger data breach (270,000 customers exposed) remains a key factor in victim targeting
Two cryptocurrency-related kidnapping cases reached judicial conclusions this week in France. The last suspect in the kidnapping of David Balland, co-founder of Ledger, was arrested in Spain after 14 months on the run. Meanwhile, 7 individuals were arrested in the violent kidnapping of a retired couple in Sallanches, targeted because of their son’s cryptocurrency investments.
These arrests come amid an alarming backdrop: France recorded one crypto-related assault every five days in 2026, an unprecedented rate that makes it the global epicenter of this phenomenon.
Ledger case: end of the road for the last suspect
On March 20, 2026, the Spanish Civil Guard apprehended a 24-year-old Frenchman in Benalmadena, on the Costa del Sol, pursuant to a European arrest warrant. He was the last remaining fugitive from the commando that kidnapped David Balland and his wife on the night of January 21, 2025, from their home in Mereau (Cher department).
The operation mobilized a significant law enforcement deployment, including a helicopter and numerous vehicles. The Civil Guard justified this show of force due to “the dangerousness of the individual” and “the possibility that the criminal organization might attempt to free him.”
The fugitive had moved through several Spanish cities — Valencia, Seville, Cadiz — before settling in Benalmadena, living in apartments rented through online platforms and funded by a fellow gang member’s bank card.
Background on the Balland case
On January 21, 2025, three armed and masked men held David Balland and his wife captive for 48 hours in a house in Chateauroux. The ransom demanded was 10 million euros in Bitcoin. To apply pressure, one of Balland’s fingers was amputated and sent to his business associates. His wife was found locked in the trunk of a car south of Paris. Both victims were rescued by the gendarmerie.
With this latest arrest, French authorities confirm that “all gang members have been identified and arrested,” including the alleged mastermind, Badiss Mohamed Amide Bajjou, arrested in Morocco in June 2025.
Sallanches: elderly couple kidnapped over their son’s crypto
On March 24, 7 suspects — 6 men and 1 woman — were arrested in connection with the kidnapping of a retired couple in Sallanches (Haute-Savoie), which occurred on the night of January 14-15, 2026.
An armed commando raided the elderly couple’s home. Their son is a cryptocurrency investor. The kidnappers demanded 8 million euros in crypto, sending videos of the captives to their son to apply pressure. The couple was released on January 16 near Montelimar (Drome), with knife wounds and restraint marks.
Investigators from the Chambery Research Section traced the suspects through adhesive materials found at the detention site, located 200 meters from the release point. Charges include organized extortion, money laundering, and criminal conspiracy.
France: the global epicenter of crypto kidnappings
These two cases are part of a concerning structural trend. According to data compiled by industry experts, France accounts for approximately 80% of crypto kidnappings in Europe and 16 of the 23 physical assaults reported worldwide in 2026.
The pace has accelerated considerably: from 10 documented cases between 2017 and 2024, the figure rose to over 20 cases in 2025 alone, then approximately 15 cases since the beginning of 2026 — one assault every five days.
The most alarming development concerns targeting. Criminals now go after family members — parents, spouses, children — rather than the crypto holders themselves. The cases in Sallanches (retired parents), Saint-Martin-le-Vinoux (mother and daughter kidnapped for 30 hours in February), and Paris (father of a crypto millionaire, finger severed in May 2025) illustrate this strategy.
The role of data breaches
The 2020 Ledger data breach, which exposed the names and addresses of 270,000 customers, remains a determining factor in victim targeting. Other breaches — the Waltio tax platform, and even a tax official caught selling fiscal data to a criminal network — fuel this economy of violence.
The implementation of the European DAC8 directive on January 1, 2026, which requires crypto platforms to report their clients’ transactions to tax authorities, also raises concerns about the creation of new vulnerabilities.
Protection measures in France
In response to the scale of the phenomenon, Interior Minister Bruno Retailleau announced several measures: priority access to the 17 emergency line for crypto professionals, a dual point of contact with ComCyberMI, home security visits by police officers, and an anonymization decree allowing crypto holders to protect their personal addresses — 40,000 requests have already been filed.
Sebastien Martin, president of the Web3 Security League, sums up the situation: “The phenomenon is not slowing down. It’s a structural evolution of organized crime. They want to get crypto — unfortunately, it’s a false good idea: everything is traceable.”
Glossary
- Cryptocurrency : A decentralized digital currency operating on a blockchain, without banking intermediaries.
- Ledger : A French company and global leader in hardware wallets (cold wallets) for securing cryptocurrencies, valued at 1.3 billion euros.
- Bitcoin : The first cryptocurrency, created in 2009 by Satoshi Nakamoto. A peer-to-peer digital asset limited to 21 million units.
- Cold wallet : A hardware wallet disconnected from the internet used to store cryptocurrencies securely.
- Seed phrase : A series of 12 or 24 words used to restore access to a crypto wallet. Disclosing it grants full access to funds.
- DAC8 : A European directive that came into effect on January 1, 2026, requiring crypto platforms to report their clients’ transactions to tax administrations.
Frequently Asked Questions
How many crypto kidnappings have occurred in France in 2026?
Approximately 15 cases since the beginning of 2026, or one assault every five days on average. France accounts for 80% of European cases and about 70% of cases worldwide.
Who was arrested in the Ledger kidnapping case?
All members of the commando have been identified and arrested. The last fugitive, a 24-year-old Frenchman, was apprehended in Spain on March 20, 2026 after 14 months on the run. The alleged mastermind was arrested in Morocco in June 2025.
How to protect yourself from crypto-related assaults in France?
Never publicly disclose your crypto holdings, use a cold wallet, apply for the anonymization decree from the authorities (40,000 requests already filed), and contact the 17 emergency line or ComCyberMI in case of threat.
What is the link between the Ledger data breach and the kidnappings?
The 2020 breach exposed the names and addresses of 270,000 Ledger customers. This widely circulated data allows criminals to identify and locate cryptocurrency holders.
Sources
This article is based on the following sources:
- Bitcoin.com News — Spanish Law Enforcement Arrests French Fugitive Linked to Violent Crypto Kidnapping, March 25, 2026
- Journal du Coin — Crypto extortion: 7 suspects arrested after the violent Sallanches kidnapping, March 24, 2026
- Decrypt — Arrest Made in Violent Kidnapping of Ledger Founder, March 21, 2026
- Franceinfo — Cryptocurrencies: the wave of kidnappings targeting the sector shows no signs of slowing, March 2026
How to cite this article: “Crypto Kidnapping: Double Arrest in Spain and Sallanches,” Fibo Crypto, March 26, 2026.
The simplest way to buy, swap and manage your crypto
Join the first users and get priority access. No seed phrase, fees 3.5x lower, built-in DeFi yield.
Get early access →
