Festo Ivaibi couldn't escape. He was on what was supposed to be a quick drive to clear his head near the waterside in Kampala, Uganda, when three cars suddenly surrounded him. Five armed people came up to his car, some dressed in what appeared to be military uniforms. "They knocked on my car window. I tried to reach out to my phone, but I realized that probably they could shoot or something," Ivaibi said. "I just didn't know what to do. I just started praying." The assailants blindfolded him and took him away in one of their cars. "I was in the back seat, and there were two people pressing my head down," the 36-year-old said. "They were telling me they were from the army and they were taking me to a torture house." His captors said they were seeking a ransom — but not cash. "We know you have been doing cryptocurrencies and you have a lot of money, and we want you to transfer $500,000," Ivaibi, the founder of the cryptocurrency educational hub Mitroplus Labs, remembers his kidnappers saying. They took two of his iPhones, which gave the perpetrators access to $120,000 worth of the stablecoin tether and $18,000 worth of Mitroplus Lab's meme coin, afro token. He got glimpses of his captors when they would remove his blindfold and use his full face to unlock his phone and access his crypto accounts. "The gun was, most of the time, pointed near my thigh, and sometimes at my head," he said. After a little over five hours, the perpetrators left him about 11 miles from his home. Stranded just after midnight with no money, no phone and no car, Ivaibi was able to stop a motorcycle taxi and pleaded for the man to help him. Ivaibi had been the victim of a classic crime with a modern twist: crypto kidnapping. It's been around for nearly a decade but has become increasingly common in recent years as the value of cryptocurrencies has soared and facial recognition technology has allowed assailants easy access to victims' phones. In a review of news reports and legal documents, NBC News identified 67 incidents of crypto kidnapping involving a target or their family member in 44 countries, on every continent except Antarctica. Crypto-related abductions increased every year since 2019, the NBC News analysis found. In 2024, NBC News identified 17 instances of cryptocurrency-related kidnappings, the highest reported number in the last decade. 2025 has already seen that many reported cases. Crypto kidnappings attracted attention in the U.S. in May when two men were arrested for allegedlykidnapping and torturing a maninside his home in New York City in an attempt to steal his bitcoin. The kidnappings are part of a wider category of incidents known as "wrench attacks" — when perpetrators attack their victims in the real world as a means of acquiring their cryptocurrencies. The term "wrench attack" comesfrom a comicwhere two figures talk about stealing someone's cryptocurrency by hitting them with a "$5 wrench." NBC News identified over 150 alleged wrench attacks worldwide in the past decade and spoke to three individuals who shared their personal experiences. In these examples, perpetrators attempted to obtain the victim's cryptocurrency through home invasion, extortion, blackmail, armed robbery, swatting, assault or even murder. When Rocelo Lopes received a call from an unknown number in the middle of his workday, he thought it was a scam. But when they called a second time, he picked up and heard his wife's voice through the receiver. He realized something was wrong. Lopes' wife had been kidnappedin broad daylightin the Brazilian city of Florianópolis after dropping their daughter off at school. Her captors held her in an apartment in the East Zone of São Paulo, an area overtaken by the Capital's First Command, the largest criminal network in the country. They demanded that Lopes hand over his cryptocurrencies. "We don't want f-----g reais,"they told Rocelo over the phone, referring to Brazil's currency. "We want it in coins, in cryptocurrencies, understand?" He appeared in local newspapers and television programs that said he made "a fortune manufacturing bitcoin," which he now believes put a target on him and his family. "Most people in the cryptocurrency space, with the intention of making everyone use it, with the intention of promoting it, end up making a very serious mistake," Lopes said, "and that is to expose themselves." His wife's kidnapping coincided with a monumental year for bitcoin. The cryptocurrency hadhit what at the time was an all-time highof $20,000 anddebuted on CME,the world's largest futures exchange. A single bitcoin was worth about $117,000 as of Friday. Marilyne Ordekian, a doctoral candidate at University College London who co-authoreda study on wrench attacks, said her research found a direct correlation between the number of attacks and the rise and fall of the price of bitcoin.A report from the blockchain analytics firm Chainalysishad similar findings. TheBBC reportedin May that 20 people were arrested in France in connection with a string of cryptocurrency-related kidnappings. This year, David Balland, a co-founder of the French crypto-wallet firm Ledger,was kidnappedalong with his wife. As the price of bitcoin continues to reach all-time highs,hitting over $120,000this month, more attacks are projected to come. The Chainalysis report found that 2025 could potentially have "twice as many physical attacks as the next highest year on record," based on the projected rise in the price of bitcoin. The report also noted that the number of previous attacks may be even higher than recorded, as many go unreported. Ordekian's study revealed several defining characteristics of wrench attacks. One is that perpetrators often don't act alone, and that the more violent attacks usually involve two or more people. One possible reason is the need for different roles in a single attack. Some perpetrators may be responsible for the physical component of the attack, and others may be responsible for using their knowledge about cryptocurrency in order to carry out a successful transaction. Lopes felt that this was the case with his wife's kidnapping. "Right at the end, the kidnapper said, 'No, I don't want it in bitcoin, because you can monitor the transaction, we want it in zcash, and we want it in monero,'" Lopes said. "I mean, so the guys more or less had someone giving them a tip, to tell them exactly which cryptocurrency it should be." All bitcoin transactions are recorded publicly, but users can protect their identities. Zcash and monero are "privacy coins" that allow users to shield details of their transactions, making them harder to trace than some other coins and cryptocurrencies. Two people were charged in the alleged cryptocurrency-related abduction in New York from this May. Both men, John Woeltz and William Duplessie, appeared to have come from cryptocurrency backgrounds — Woeltz was once known as the "Crypto King of Kentucky." They were also allegedly involved in the physical aspect of the attack, accused of torturing their victim with waterboarding, headbutting, beating and the use of electric wires, according to court documents. Woeltz and Duplessie were granted bail on Wednesday, according to court records, after they had pleaded not guilty on all charges. Their lawyers did not respond to a request for comment. Muhammad Arsalan, a 23-year-old crypto influencer from Pakistan, said he was kidnapped in December. He told NBC News that around eight people were involved in his abduction. Similar to Ivaibi's case, Arsalan said he was taken into a vehicle and extorted for his tether (USDT) holdings. "They stopped the car and told me, 'Show your account.' I said, 'I have nothing. I have nothing,'" Arsalan said. "So they told me, 'You have 40,000 USDT. Can you please show us? Otherwise we will kill you. We have a gun. We have rifles.'" On the day he was kidnapped, Arsalan was forced to surrender $340,000 worth of tether. When he got home to check his Binance account, he stared in awe after seeing that his wallet was wiped clean. "I had no options left. This is my whole life savings. This is all my life's money," Arsalan said. "I have no words to tell you what I feel at that time." Ordekian said that in most cases, perpetrators are successful in taking money from their victims. Lopes' case was an outlier. His wife was held captive for four days while there were deliberations over the ransom amount, and the authorities were eventually able to rescue her before he had to give up any money. Police located Lopes' wife in a three-story building in São Paulo, according to Anselmo Cruz, who works for the anti-kidnapping division of the civil police in the Brazilian state where Lopes' wife was abducted. Cruz added that when police broke into the building, they arrested at least one person and removed Lopes' wife, finding that she did not sustain any physical injuries. A spokesperson for São Paulo's Public Safety Department said in a statement to NBC News that four other people were later indicted in connection with the crime. Lopes said it was later revealed that the people who had kidnapped his wife had been planning the abduction for nine months. "They wanted a stratospheric amount. They wanted an amount that didn't exist," Lopes said. Lopes said his wife's captor had misunderstood the amount of crypto Lopes had. Lopes had previously transacted with one of his wife's captors and sent him bitcoin, he said, but the interaction gave that person the wrong impression about how much money Lopes actually had. "The guy didn't understand because he thought that the bitcoin I sent him was mine," Lopes said. "They got confused — one thing what's in my wallet, another thing what's in a brokerage firm's wallet." Ordekian says perpetrators' familiarity with their victims is another characteristic that is common in these cases, especially for figures like Arsalan, Lopes and Ivaibi who have built a strong online presence. Like in Lopes' case, the other people affected by crypto kidnappings who spoke to NBC News had connections to some of their assailants. Arsalan's perpetrators had messaged him on Instagram about purchasing tether from him prior to his abduction. Ivaibi said that one of the people involved in his kidnapping was a family friend. Woeltz and Duplessie are alleged to have known their victim personally for several years, according to prosecutors. How a case is handled depends a lot on what country a victim resides in. Ordekian noted there is "currently no definition of a wrench attack in legislation or academic work," which can make it difficult to form legal protections against this specific form of attack. In Pakistan, the current legal state of cryptocurrency is fluid, making Arsalan's case difficult to navigate. Pakistan's government has been critical of cryptocurrency but has also taken some steps that recognize its increasing legitimacy. Arsalan eventually filed a complaint with Karachi police, despite having been threatened with murder by his captors if he were to go to the authorities. The alleged perpetrators were arrested within three days after Arsalan filed a complaint. The case is still active. "Pakistani systems are very slow and very lazy, and they also don't know about how crypto works," Arsalan said. "They are just confused about this all, and right now I'm waiting for seven months." Uganda similarly has a lack of regulation around the use of cryptocurrency. Despite this, Ivaibi said he had support from the authorities, who placed at least one perpetrator in custody, according toa Mitroplus Labs press release. Uganda's Ministry of Finance, Planning and Economic Developmenthas saidthat cryptocurrency would be unregulated in the country and advised citizens to be wary of its "use in criminal transactions." Brazil currently has anumber of lawsand regulatory bodies tasked with overseeing the use of cryptocurrency. One is the Internal Revenue Service of Brazil, which Lopes said had launched an investigation into him to impose a possible fine based on the amount of money the perpetrators had requested from him during his wife's kidnapping. The Brazilian IRS said in a statement to NBC News that it would not be able to disclose any information about the investigation due to tax privacy laws. In the wake of their kidnappings, the victims who spoke to NBC News said they've adjusted some of their protocols and practices. Lopes said that after his incident, he has made sure that all his crypto trading follows what are known as "know your customer" (KYC) procedures, which require users of cryptocurrency platforms to provide personal information, including addresses and financial data. With more data about participants who are involved in crypto transactions, law enforcement can potentially identify individuals who might be involved in wrench attacks. "We have been able to track the funds, and those funds were formed in a certain Binance account, and we were able to contact Binance through the Uganda police intelligence, and they sent us the KYC," Ivaibi said. Lopes said he has also taken measures in the real world, like making sure that his family is accompanied by security personnel, in order to avoid another attack. Ivaibi said that he also has police patrolling his home every day. But he says these aren't the only measures that should be adopted. "The authorities were not prepared — no one was prepared," Lopes said. "I told people, 'There should be a team, a team, whether from the federal police, the civil police, I don't know which department, but there should be a team ready for this type of action.'" And while many victims work to change their daily lives following their attacks, many still carry fear from their experiences. "The trauma that comes thereafter is what is really more torturing," Ivaibi said. "You feel like everything is insecure out there."