Onchain investigator ZachXBT said he helped freeze roughly $800,000 in ransom proceeds after French streamer TeufeurS paid about $2 million in cryptocurrency to secure the release of his father, who had been kidnapped in Sarthe, France in 2023. According to the details shared publicly, the recovery effort was conducted in coordination with the Binance Security team.
The case had not been publicly discussed in detail at the time because of its sensitivity. ZachXBT later disclosed on X that he and Binance Security traced the ransom payment onchain and managed to freeze a substantial portion of the funds. In crypto-related extortion cases, victims’ payments are often moved quickly across multiple wallets and services, making any meaningful recovery difficult. Against that backdrop, freezing approximately $800,000 stands out as a notable development.
How the Kidnapping Happened
The abduction took place in August 2023 in the northwestern French department of Sarthe. The attackers reportedly approached the victim while posing as Amazon delivery workers, using the disguise to get close before forcing him into a vehicle. Once in captivity, TeufeurS’s father was filmed at gunpoint. That footage was then sent directly to the streamer as leverage to demand payment.
Under pressure to save his father, TeufeurS paid around $2 million in cryptocurrency. The use of digital assets in ransom demands has become a recurring pattern in high-stakes criminal cases because funds can be transferred quickly across borders and layered through multiple wallets. Even so, blockchain records also create a traceable transaction history, which investigators and exchange security teams can sometimes use to identify and freeze assets before they fully disappear into the broader ecosystem.
French authorities have since arrested six suspects connected to the kidnapping. The public disclosure of the arrests, along with the details of the ransom tracing and freeze, adds a new layer to the case by showing that portions of crypto payments can still be intercepted when investigators move quickly and receive support from major industry platforms.
France’s Rising Crypto-Linked Security Threat
The TeufeurS case is part of a wider trend in France, where crypto wealth has increasingly been linked to physical-world threats. Reports cited in the source material indicate that criminals are using social media activity, public visibility, and perceived wealth signals to identify targets. What once may have been limited to isolated robberies has, in some instances, escalated into coordinated kidnappings and home invasions.
According to the report, local agencies have recorded more than 40 kidnappings and abductions tied to crypto since the start of this year alone, compared with 30 cases documented in 2025. The numbers suggest a worsening environment for individuals publicly associated with digital assets, whether they are investors, executives, or online personalities.
The article also points to other recent incidents in France. In February, three armed suspects allegedly tried to target Binance France head David Princay. In March, a couple reportedly suffered a home invasion and was forced to hand over about €900,000 worth of bitcoin, or roughly $1 million, to attackers who were said to be impersonating local authorities. Together, these cases suggest that crypto-related crime in France is no longer confined to online theft or scams; it increasingly includes direct physical coercion.
The Role of Onchain Investigators
ZachXBT has become one of the most recognized independent figures in the world of onchain investigations, especially in cases involving theft, laundering, and illicit fund flows. His involvement in this incident underscores how blockchain intelligence can intersect with traditional criminal investigations. By following wallet activity and coordinating with centralized platforms that have the ability to act on suspicious flows, investigators can sometimes limit losses even after funds have been transferred.
At the same time, ZachXBT noted separately that he generally avoids taking cases in jurisdictions where law enforcement cooperation is unlikely to produce results. That observation highlights a broader issue for the crypto sector: fund recovery often depends not only on tracing expertise, but also on the willingness and capacity of exchanges, security teams, and local authorities to respond in time. In some jurisdictions, those elements align. In others, they do not.
The TeufeurS case therefore reflects two realities at once. First, public association with crypto wealth can create serious real-world security risks. Second, while digital assets are often portrayed as ideal tools for extortion because of their speed and borderless nature, they are not beyond reach when investigators can trace transactions and coordinate quickly with major industry actors.
For market participants, the incident is another reminder that operational security now extends beyond wallets, passwords, and phishing protection. Public visibility, personal routines, and family exposure may also become risk factors when crypto holdings are known or inferred. And for law enforcement and security teams, the case offers a concrete example of how collaboration between private investigators and exchange infrastructure can make a measurable difference, even in violent crimes where time is critical.