The Chainalysis report found that 2025 could potentially have “twice as many physical attacks as the next highest year on record,” based on the projected rise in the price of bitcoin. The report also noted that the number of previous attacks may be even higher than recorded, as many go unreported.

Ordekian’s study revealed several defining characteristics of wrench attacks. One is that perpetrators often don’t act alone, and that the more violent attacks usually involve two or more people.

One possible reason is the need for different roles in a single attack. Some perpetrators may be responsible for the physical component of the attack, and others may be responsible for using their knowledge about cryptocurrency in order to carry out a successful transaction.

Lopes felt that this was the case with his wife’s kidnapping.

“Right at the end, the kidnapper said, ‘No, I don’t want it in bitcoin, because you can monitor the transaction, we want it in zcash, and we want it in monero,’” Lopes said. “I mean, so the guys more or less had someone giving them a tip, to tell them exactly which cryptocurrency it should be.”

All bitcoin transactions are recorded publicly, but users can protect their identities. Zcash and monero are “privacy coins” that allow users to shield details of their transactions, making them harder to trace than some other coins and cryptocurrencies.

Two people were charged in the alleged cryptocurrency-related abduction in New York from this May. Both men, John Woeltz and William Duplessie, appeared to have come from cryptocurrency backgrounds — Woeltz was once known as the “Crypto King of Kentucky.”

They were also allegedly involved in the physical aspect of the attack, accused of torturing their victim with waterboarding, headbutting, beating and the use of electric wires, according to court documents. Woeltz and Duplessie were granted bail on Wednesday, according to court records, after they had pleaded not guilty on all charges. Their lawyers did not respond to a request for comment.

Muhammad Arsalan, a 23-year-old crypto influencer from Pakistan, said he was kidnapped in December. He told NBC News that around eight people were involved in his abduction. Similar to Ivaibi’s case, Arsalan said he was taken into a vehicle and extorted for his tether (USDT) holdings.

“They stopped the car and told me, ‘Show your account.’ I said, ‘I have nothing. I have nothing,’” Arsalan said. “So they told me, ‘You have 40,000 USDT. Can you please show us? Otherwise we will kill you. We have a gun. We have rifles.’”

On the day he was kidnapped, Arsalan was forced to surrender $340,000 worth of tether. When he got home to check his Binance account, he stared in awe after seeing that his wallet was wiped clean.

“I had no options left. This is my whole life savings. This is all my life’s money,” Arsalan said. “I have no words to tell you what I feel at that time.”

Ordekian said that in most cases, perpetrators are successful in taking money from their victims. Lopes’ case was an outlier. His wife was held captive for four days while there were deliberations over the ransom amount, and the authorities were eventually able to rescue her before he had to give up any money.

Police located Lopes’ wife in a three-story building in São Paulo, according to Anselmo Cruz, who works for the anti-kidnapping division of the civil police in the Brazilian state where Lopes’ wife was abducted.

Cruz added that when police broke into the building, they arrested at least one person and removed Lopes’ wife, finding that she did not sustain any physical injuries. A spokesperson for São Paulo’s Public Safety Department said in a statement to NBC News that four other people were later indicted in connection with the crime.

Lopes said it was later revealed that the people who had kidnapped his wife had been planning the abduction for nine months.

“They wanted a stratospheric amount. They wanted an amount that didn’t exist,” Lopes said.

Lopes said his wife’s captor had misunderstood the amount of crypto Lopes had. Lopes had previously transacted with one of his wife’s captors and sent him bitcoin, he said, but the interaction gave that person the wrong impression about how much money Lopes actually had.

“The guy didn’t understand because he thought that the bitcoin I sent him was mine,” Lopes said. “They got confused — one thing what’s in my wallet, another thing what’s in a brokerage firm’s wallet.”

Ordekian says perpetrators’ familiarity with their victims is another characteristic that is common in these cases, especially for figures like Arsalan, Lopes and Ivaibi who have built a strong online presence.

Like in Lopes’ case, the other people affected by crypto kidnappings who spoke to NBC News had connections to some of their assailants.

Arsalan’s perpetrators had messaged him on Instagram about purchasing tether from him prior to his abduction. Ivaibi said that one of the people involved in his kidnapping was a family friend. Woeltz and Duplessie are alleged to have known their victim personally for several years, according to prosecutors.

How a case is handled depends a lot on what country a victim resides in.

Ordekian noted there is “currently no definition of a wrench attack in legislation or academic work,” which can make it difficult to form legal protections against this specific form of attack.

In Pakistan, the current legal state of cryptocurrency is fluid, making Arsalan’s case difficult to navigate. Pakistan’s government has been critical of cryptocurrency but has also taken some steps that recognize its increasing legitimacy.

Arsalan eventually filed a complaint with Karachi police, despite having been threatened with murder by his captors if he were to go to the authorities. The alleged perpetrators were arrested within three days after Arsalan filed a complaint.

The case is still active.

“Pakistani systems are very slow and very lazy, and they also don’t know about how crypto works,” Arsalan said. “They are just confused about this all, and right now I’m waiting for seven months.”