Telegram CEO warns of data-fueled crypto kidnappings

TLDR

Telegram founder Pavel Durov is warning that leaked tax and investor data is driving a surge in crypto-related kidnappings in France.

1. Durov says France has seen around 41 crypto-holder kidnappings in early 2026, and blames leaked state and investor data for helping criminals pick targets.
2. France has become a hotspot for violent wrench attacks, where victims are physically forced to transfer crypto, showing how data and on-chain wealth make users vulnerable.
3. French authorities are responding with arrests and prevention programs, while crypto users should treat privacy and personal security as core parts of risk management.

Deep Dive

1. What Durov Is Warning About

In recent comments, Pavel Durov said France has recorded about 41 kidnappings involving crypto holders in the first months of 2026, roughly one attack every 2.5 days, and linked this to massive tax and investor data leaks that expose high net worth individuals to organized crime networks. He summarized the pattern as More data = more victims, arguing that once criminals know names, addresses, and approximate holdings, it becomes straightforward to plan abductions and extortion against specific crypto users, rather than random targets. Reports detail prior cases such as the kidnapping of a Ledger co-founder and attacks on crypto entrepreneurs families in Burgundy and other regions, reinforcing that this is now a repeated pattern rather than isolated incidents.sharp increase in crypto-related kidnappings

2. How Data and Crypto Combine Into Physical Risk

Analysis cited by Durov suggests France is about 12 times riskier for crypto investors than most European regions, with dozens of crypto-linked kidnappings in 2026 and losses from so-called wrench attacks (physical assaults where victims are coerced at gunpoint or with tools to unlock wallets) already exceeding prior years.France 12x riskier and $106 million losses Separate reporting counts more than 135 crypto kidnapping incidents in France since 2023, accounting for roughly 40 percent of European crypto ransom attacks, and describes criminals cross-referencing leaked exchange or tax data with public records and social media to find wealthy holders.France accounts for about 40 percent of European crypto ransom attacks Because blockchain balances are transparent and many users have done KYC somewhere, any leak that links identity to addresses significantly increases personal safety risk.

3. Official Response And Practical Precautions

French prosecutors have charged 88 people, including minors, in relation to crypto kidnappings, and the Interior Ministry has announced stricter response plans plus a prevention platform targeted at digital asset holders.France charges suspects and launches prevention platform Durov, for his part, argues that expanding government access to communication and financial data without strong safeguards only enlarges the attack surface, and has said he would rather exit the French market than grant authorities access to private Telegram messages.privacy versus state surveillance conflict

For individual crypto users, practical precautions include keeping a low public profile about holdings, separating real-world identity from major on-chain addresses where possible, using cold storage for significant amounts, and being cautious about who holds your KYC and tax data.

Conclusion

Durovs warning highlights that as crypto matures, the main attack surface is shifting from pure cybercrime toward data-driven targeting of individuals in the physical world. France is currently the most visible example, but the underlying mechanism - centralized leaks mapping real identities to large crypto balances - is global. For serious holders, privacy practices and personal security planning are becoming as important as asset selection or choice of wallet.