Updates

Data

• 31 records removed as outside the scope of the record: 30 kidnappings or extortions in which crypto-assets were only the means of paying the ransom, the victim neither holding any nor being targeted for them (for example WA147, a gym-chain owner abducted in Costa Rica whose family paid in bitcoin; WA358, an 8-year-old girl kidnapped in Maiduguri; WA395, Igor Komarov in Bali), and WA504 (New Orleans, October 2021), a theft without violence or threat.
• The "In reference list" field now records presence in Jameson Lopp's list as it stands after his import of 16 October 2026, which took in 347 cases from this record: 646 of the remaining cases are in that list, 24 are not.
• The record now holds 670 cases in 72 countries, from January 2020 to 15 October 2026.

Methodology

• Scope restated: the record covers violent attacks, or physical threats, against a person because they hold crypto-assets or are believed to. A kidnapping or extortion in which crypto-assets are only the means of paying the ransom, with no party holding them or targeted for them, is excluded, as are thefts without violence and frauds. A holder whose own crypto-assets are taken by force is included even when the attack had another starting point.

Data

• 35 cases added in 16 countries: 1 that occurred since the previous release (Istanbul, 5 October 2026: a businessman abducted by men posing as police officers and forced to transfer crypto-assets) and 34 earlier cases found by the new searches, 13 of them in Taiwan, mostly through court judgments. First cases recorded in Croatia.
• Cases added by country: Taiwan 13, Hong Kong 3, China 3, Moldova 2, Serbia 2, United States 2, Bulgaria, Croatia, Lithuania, Montenegro, Romania, Canada, France, Belgium, India and Türkiye 1 each.
• 3 records removed: WA399 (Hsinchu, March 2026), after the judgment established that the money had been handed over by deception, with no violence or threat; L092 (Tseung Kwan O, July 2024) and WA388 (Tucson, February 2026), kidnappings in which the only crypto-asset element was a ransom demanded from a family holding none — outside the scope set on 11 October.
• 22 records corrected or completed, mostly with court outcomes: sentences in the Los Angeles case against Adam Iza and a former sheriff's deputy (L029, L043, WA098), appeals and sentences in Taiwan, Hong Kong and Poland (WA024, WA025, WA043, WA101, WA216, WA251, WA337, WA365, WA459, L013), the final conviction in the Plancher-Bas case (L025). WA239 (Revelo Intel, 2024) is now rated low confidence, as it rests only on the victim's own public statement.
• The record now holds 701 cases in 74 countries, from January 2020 to 15 October 2026.

Methodology

• A theft in which the money is handed over by deception and only snatched or kept, with no violence or threat against the person, is excluded even when it took place during an in-person crypto trade.

Site

• Correction from the reading of the site: the overview no longer says that the United States ranks second by number of cases; with 63 cases Taiwan has moved ahead of it (62), and the rank is now computed at each release.

Site

• New Updates page (this page), listing every update with what changed in the data, the method and the site. The site text is now reread at every update.
• Corrections from a full reading of the site: the growth from 2023 to 2025 is now given in figures (72 to 167 cases) instead of "doubled"; the share of Taiwan's cases that are robberies during in-person trades is now counted (28 of 51) instead of "almost all"; the note on confidence intervals no longer says that every country has five to thirty cases (France now has 80 in the window).
• The statement that the two highest-ranked countries cannot be told apart now depends on whether their confidence intervals actually overlap.
• Survey names in the per-holder table are given in English (Bank of Canada; Adan / Ipsos 2026 Barometer; Bundesbank, Payment Behaviour in Germany 2025).
• The Methodology page now describes the weekly update process.
• Links to the site shared on social networks now show a preview card (title, key figures and the yearly chart), refreshed at every update.

Data

• 38 cases added in 16 countries: 8 that occurred since the previous release and 30 earlier cases found by the new searches. First cases recorded in Switzerland, Bangladesh and Uruguay.
• 33 records merged into another record of the same case. Most were cases from the reference list that had been recorded a second time alongside the same case found by the original search; others were series summaries that overlapped records of the individual attacks, or the same victim recorded once per episode of a single campaign.
• 3 records removed: WA201 (Cluj, January 2024), after police established that the account had been staged; WA112 (São José dos Campos, June 2022), where the ransom was demanded in reais and no crypto-asset was involved; WA363, a summary of a series of attacks in California whose victims each have their own record.
• 41 records corrected or completed, mostly with court outcomes (sentences, charges, arrests). Notable corrections: WA236 now describes the kidnapping in Danbury on 25 August 2024, not only the aborted attempt that preceded it; WA352 records that nothing was taken; WA192 no longer counts an unpaid ransom as an amount taken.
• The record now holds 669 cases in 72 countries, from January 2020 to 11 October 2026.

Methodology

• The record is now updated every week. Each update searches news coverage in the local language across 57 national editions, the reference list and its repository, court-record databases and police statements. Headlines are pre-screened automatically; every candidate is then read and checked individually against its sources, with a second independent source sought, before it is added.
• Country and per-holder rates are recomputed from the cases at every release, with the method unchanged: attacks on personal assets over the 36 months to the closing date, per person aged 15 and over, with a 95% interval. The window now runs from 12 October 2023 to 11 October 2026.
• Scope clarified: a kidnapping in which a victim who does not hold crypto-assets is forced to buy some to pay a ransom is excluded, the crypto-asset being only the means of payment. A victim attacked several times by the same group in a single campaign counts as one case. A summary of a series is not counted when its attacks have their own records.
• The whole record was checked for duplicates, including cases dated only to the month or year.

Site

• Figures quoted in the text — the comparison of per-holder rates between France, the United States and the United Kingdom, the countries with the most cases absent from the reference list, the share of severe outcomes in Brazil, and the period covered for the current year — are now computed at each release instead of being written by hand.
• The spreadsheet download (attacks.csv) is now generated from the same data as attacks.json.

Data

• 667 records in 69 countries, from January 2020 to 12 September 2026, built from the public reference list and a search of local-language press in around thirty languages, court records and police statements.

Methodology

• Scope, search strategy, verification and risk measures as described on the Methodology page.

Site

• Overview, Findings, Risk, Methodology and Data pages; JSON and CSV downloads.