Part of the CustodyStress archive of observed Bitcoin custody incidents
CS-01341
Physical coercion — hardware wallet (2025)
BlockedCase description
A Brazilian Bitcoin holder's family member was kidnapped in April 2025 and held for ransom payable in Bitcoin. The kidnappers specified the ransom must be paid in Monero rather than Bitcoin, demonstrating operational knowledge of cryptocurrency transaction traceability—specifically, that Bitcoin transactions are visible on a public blockchain while Monero transactions are private. The holder was forced to first purchase Monero on a Brazilian exchange and then transfer it to the kidnappers' wallet. The NBC News investigation into crypto kidnappings in 2025 included this case as an example of organised criminal groups demonstrating technical cryptocurrency knowledge to maximise their operational security.
Custody context
| Stress condition | Physical coercion |
| Custody system | Hardware wallet (single key) |
| Outcome | Blocked |
| Documentation | Unknown |
| Year observed | 2025 |
| Country | Brazil |
Structural dependencies observed
What this illustrates
Access required in-person verification that couldn't be arranged under the circumstances. Access was not recoverable.
Outcome interpretation
Access was not possible under the reported conditions.
Source
Publicly Reported
Evidence type
News article
Related cases involving physical coercion
105 cases involve physical coercion
274 cases involve hardware wallet (single key)
View archive statistics →
This archive documents observed custody survivability failures. It does not attempt to document all Bitcoin losses or security incidents.
Submit a case
← All cases
Framework references
Where Bitcoin Custody Intersects Legal and Fiduciary Authority
Where custody creates gaps in estate planning, fiduciary duty, and professional responsibility.
Professional Scope Boundary Matrix
What each professional or product covers, what they do not, and where gaps form between them.
The Independent Assessment Layer in Bitcoin Custody
How independent diagnostic layers emerge when multiple parties depend on shared infrastructure.
Translate