Physical Threats Against Virtual Currency

Physical Threats Against Virtual Currency
October 30, 2024 sdcpm
Physical Threats Against Virtual Currency - TorchStone Global

Physical Threats Against Virtual Currency

By TorchStone Senior Analyst, Ben West

Cryptocurrency kidnapping plots highlight the physical threat associated with electronic assets. Kidnapping gangs are bypassing network security measures and targeting the humans behind the accounts with violence in order to steal their assets. Investors can mitigate the associated risks by identifying and addressing threats before they become a victim.

To most outside observers, the men who got out of a van and entered a residence in Tallinn, Estonia the evening of July 29 would not have raised much suspicion. They appeared to be painters simply doing their job along Tallinn’s picturesque Rataskaevu Street. They certainly were not trying to hide in their bright yellow safety vests.

However, once inside the building, it became clear that they were not there for remodeling work. The building was the home of one of the richest men in Estonia, Australian national Tim Heath. As soon as the team identified Heath in the stairwell, they attacked him. Heath was able to fight them off and call for help and the men quickly fled the country. One was later arrested in Lithuania.

Estonian prosecutors say that the men were part of an elaborate cryptocurrency kidnapping plot and had planned their attack for months. They had purchased all the tools they needed to pose as contractors (and possibly to restrain Heath had they abducted him) and rented an Airbnb about 30 minutes outside of Tallinn. It’s likely that the group was planning to incapacitate Mr. Heath, bundle him into their van, and drive him to the remote vacation home as part of the plot.

The abductors clearly anticipated that it would be a quick job: they had only rented the Airbnb for two days.

Tim Heath was a very specific target: he had moved to Estonia in the early 2000s and invested in online gaming and cryptocurrency. He was very publicly featured on the Financial Review’s “Rich List” in May 2024 with an estimated net worth of $2.27 billion and was a regular contributor to discourse on cryptocurrency. On the day of his failed abduction, he was preparing to open an opulent casino just down the street from where he lived. Associates noted that Heath was noticeably absent from the casino’s grand opening in August. Media reports suggest that Heath had fled Estonia after the attempted kidnapping and that his current location is unknown. Even if the kidnapping was not successful, it certainly caused a significant disruption to Mr. Heath’s business plans and personal life.

Not For the First Time

Heath fit the profile of a cryptocurrency investor that has become a popular target for kidnapping gangs in recent years. And while Heath was able to fight off his would-be abductors, others have suffered injury and significant financial losses.

In November 2023, four suspects flew from Florida to Portland, OR, rented an Airbnb in nearby Vancouver, WA, and conducted surveillance on a downtown Portland apartment for two days in preparation for a kidnapping attack targeting a cryptocurrency investor. On Nov. 10, the group launched their attack, with some members detaining their target while others stayed behind to collect information at the target’s home concerning investments. The group drove him to a field about 30 minutes west of Portland, duct-taped him to a post, and tortured him until they recovered enough information to transfer an undisclosed amount of cryptocurrency out of the victim’s account.

A review of recent cryptocurrency abduction plots demonstrates that the pattern that The Watch identified in 2022 still holds today: identify a target who holds large amounts of cryptocurrency and threaten them with their life until they provide the necessary information to transfer the money out of their accounts. Cryptocurrency gangs often invest substantial time and resources into identifying their victims and plotting their attacks. A federal conviction in June 2024 revealed that the gangs gain unauthorized access to their victim’s email and conduct surveillance on their targets before launching their attack—typically at the victim’s residence. Whereas online cash transfer services like Venmo and PayPal limit transfers to $25,000 per week, many cryptocurrencies and exchanges have much higher limits—if any limits at all.

For example, just after Heath’s attempted kidnapping in August, a similar criminal group out of Florida is accused of stealing $230 million from a Washington, D.C. investor and a couple in Connecticut whose son is a cryptocurrency investor. As of October 2024, authorities still had not accounted for $100 million of the stolen property. Cryptocurrency promoters praise the anonymity and lack of regulation built into many of the currencies—but these same characteristics make it easier for criminals to steal large amounts of money and make it more difficult to trace.

Physical Force Against a Virtual Target

Cryptocurrency kidnappings highlight the physical threat to virtual networks. Most cryptocurrency platforms were designed with cybersecurity in mind, making it very difficult to hack into accounts remotely and steal people’s holdings. And while criminals certainly continue virtual attacks against cryptocurrency networks (more often exploiting human than software vulnerabilities), many criminal actors have determined that it’s more effective to use force against their targets in the physical world.

While network attacks are obviously financially disastrous, cryptocurrency kidnappings add physical and psychological damage that can dramatically change, or even take, the victim’s life—even if they do preserve their assets. The specific details surrounding Mr. Heath’s evasion of his attackers are unclear (Was he taking self-defense training? Did he use a non-lethal weapon?) but relying on self-defense is not the optimal strategy for avoiding a cryptocurrency kidnapping attack. It is much better to recognize an attack before it happens and take measures to make yourself less of a target in the first place.

Understanding your online profile and what others can find out about you through anonymous online research is also key to determining how vulnerable someone is. Do you often post about cryptocurrency online? Are you considered a thought leader in the field? Are you a high-net-worth individual with properties, assets, and a social media profile to prove it? In the cases highlighted above, attackers utilized anonymous, online search techniques to identify targets and conduct research on them. Knowing what information about you is available online is key to determining your threat profile and assessing actions you can take to lower that profile.

For people holding large amounts of cryptocurrency, they need to consider their physical security just as much as their digital security. The examples cited so far have all involved substantial, physical pre-operational surveillance in the lead up to the attack. Proactive efforts to identify vulnerabilities and watch for suspicious activity are the first steps to recognizing and stopping an attack before someone gets hurt.


This is an update to a 2022 article we wrote on Crypto Kidnapping as part of a larger series on kidnapping threats.