Blockchain investigator ZachXBT has disclosed that he helped freeze roughly $800,000 in crypto ransom funds after French streamer TeufeurS paid about $2 million to secure the release of his father, who was kidnapped in Sarthe, France, in 2023. According to the account shared publicly, the recovery effort was carried out in coordination with the Binance Security team, highlighting how onchain tracing and exchange-level intervention can sometimes disrupt the movement of criminal proceeds.
How the kidnapping unfolded
The abduction took place in August 2023 in Sarthe, a department in northwestern France. The attackers reportedly posed as Amazon delivery workers in order to approach the victim without immediately raising suspicion. After making contact, they forced TeufeurS’s father into a vehicle and took him captive.
While in captivity, the victim was filmed at gunpoint. The footage was then sent directly to TeufeurS as a coercive tactic designed to pressure him into making a payment. Faced with an immediate threat to his father’s life and safety, the streamer paid approximately $2 million in cryptocurrency to obtain his release.
ZachXBT later said the details of the case had not been shared publicly at the time because of the sensitivity of the incident. Only in April 2026 did more information emerge about the role played by private-sector investigators and exchange security teams in tracing the ransom after payment.
Tracing funds and freezing part of the ransom
In a statement posted on X, ZachXBT said that after the ransom was paid, he worked alongside Binance Security to follow the funds onchain and coordinate a freeze of approximately $800,000. In crypto ransom cases, speed is critical: illicit proceeds are often split across multiple wallets, routed through services intended to obscure flows, or moved across platforms before enforcement action can be taken.
Against that backdrop, freezing nearly 40% of the total ransom represented a meaningful intervention, even if it did not recover the full amount. The case illustrates both the strengths and the limitations of blockchain-based investigations. On one hand, transaction trails can make fund movements visible. On the other, successful recovery still depends heavily on rapid coordination among investigators, compliance teams, and law enforcement.
The report says six suspects tied to the abduction have since been arrested by French authorities. That development suggests the case evolved beyond a financial investigation into a broader criminal prosecution involving the perpetrators of the kidnapping itself.
A wider pattern of crypto-linked violent crime in France
The TeufeurS case is not being viewed in isolation. It fits into a broader pattern of violent crime in France involving individuals perceived to hold significant digital assets or publicly visible wealth. According to the source material, local agencies have recorded more than 40 kidnappings and abductions linked to crypto since the start of this year, exceeding the 30 cases documented in 2025.
That trend points to a changing risk profile for crypto investors, founders, executives, and influencers. In many instances, attackers are believed to identify targets through social media activity, public-facing lifestyles, or other signals that suggest substantial holdings. Unlike purely online theft, these incidents move digital-asset crime into the physical world, where victims face immediate personal danger and may have little choice but to comply.
The article also references other incidents that reinforce the pattern. In February, three armed suspects reportedly attempted to target Binance France head David Princay. In March, a couple allegedly had their home invaded and were forced to surrender €900,000 worth of bitcoin to attackers impersonating local authorities. Together, these examples suggest that criminals are increasingly combining deception, surveillance, and offline coercion to exploit crypto wealth.
The role of private investigators and exchanges
ZachXBT has become one of the most closely watched independent figures in the field of onchain forensics, often surfacing wallet trails and fund flows tied to hacks, scams, and thefts. This case shows how that expertise can extend into real-world criminal investigations, particularly when kidnappings or extortion involve digital assets as the payment rail.
But the outcome also underlines the importance of counterparties that can act on traced funds. Investigators may identify where assets move, yet freezing them typically requires cooperation from exchanges or custodial services that have both visibility into user accounts and the ability to restrict withdrawals or transfers. In this case, Binance Security’s participation appears to have been central to stopping part of the ransom from moving further.
ZachXBT also noted separately that he generally declines cases arising from jurisdictions where law-enforcement cooperation makes recovery nearly impossible. That comment reflects a persistent reality in crypto crime response: visibility onchain does not automatically translate into enforcement success. Jurisdiction, compliance standards, legal process, and the willingness of local authorities to pursue a case all shape whether stolen or extorted funds can actually be frozen and recovered.
What the case signals for the crypto industry
For the broader crypto sector, the kidnapping of a public figure’s family member is a stark reminder that digital asset risk is no longer confined to exchange exploits or phishing scams. As crypto ownership becomes more visible, criminals may increasingly target individuals offline, especially if they believe victims can quickly transfer large sums without the friction associated with the traditional banking system.
The case also highlights a difficult contradiction at the heart of the industry. The same features that make crypto efficient for global transfers can make it attractive in extortion scenarios. At the same time, public blockchains create transaction histories that can support investigations after the fact. Whether those investigations lead to meaningful recovery often depends on how quickly threat intelligence, exchange compliance, and police action come together.
In the TeufeurS case, the full ransom was not recovered, but the freezing of roughly $800,000 stands out as a substantial result in a category of crime where funds frequently disappear before responders can intervene. With six arrests reported and the details only now entering public view, the incident serves as both a case study in rapid post-payment tracing and a warning about the intensifying physical security risks tied to visible crypto wealth.