‘Wrench attacks’ on wealthy crypto holders on the rise

The headline-grabbing tale of an Italian man who said he was kidnapped and tortured for weeks inside an upscale Manhattan townhouse by captors seeking his bitcoin highlights a dark corner of the cryptocurrency world, the threat of violence by thieves seeking digital assets.

The alleged attempted robbery is known as a ‘wrench attack’. It’s a name popularised by an online comic that mocked how easily high-tech security can be undone by hitting someone with a wrench until they give up passwords.

Wrench attacks are on the rise thanks in part to cryptocurrency’s move into mainstream finance, Phil Ariss of the crypto tracing firm TRM Labs said in a recent blog post.

“Criminal groups already comfortable with using violence to achieve their goals were always likely to migrate to crypto,” Ariss said.

Some of the crypto’s key characteristics help explain why wealthy individuals who hold a lot of digital assets can be ripe targets for such attacks.

Cryptocurrencies like bitcoin offer traders full control of their funds without the need for a bank or permission from a government to buy, sell or hold it. The trade-off is that if funds are lost or stolen, there can be no way to get them back.

Self-reliance is a key ethos of crypto. Securing and controlling one’s private keys, which are like passwords used to access one’s crypto holdings, is viewed as sacrosanct among many in the crypto community. A popular motto is,‘Not your keys, not your coins’.

Transactions on the blockchain, the technology that powers cryptocurrencies, are permanent. And unlike cash, jewellery, gold or other items of value, thieves don’t need to carry around stolen crypto. With a few clicks, huge amounts of wealth can be transferred from one address to another.

In the case in New York, where two people have been charged, a lot of details have yet to come out, including the value of the bitcoin the victim possessed.

Stealing cryptocurrency is almost as old as cryptocurrency itself, but it’s usually done by hacking. North Korean state hackers alone are believed to have stolen billions of dollars’ worth of crypto in recent years.

In response to the threat of hacking, holders of a large amount of crypto often try and keep their private keys off the internet and stored in what are called ‘cold wallets’. Used properly, such wallets can defeat even the most sophisticated and determined hackers.

But they can’t defeat thieves who force a victim to give up their password to access their wallets and move money.

The case in New York is the latest in a string of high-profile wrench attacks. Several have taken place in France, where thieves cut off a crypto executive’s finger.

Experts suggest several ways to mitigate the threats of wrench attacks, including using wallets that require multiple approvals before any transactions.

Perhaps the most common way crypto-wealthy individuals try to prevent wrench attacks is by trying to stay anonymous. The use of nicknames and cartoon avatars in social media accounts is common in the crypto community, even among top executives at popular companies.

Meanwhile, in the Manhattan case, a grand jury has indicted a cryptocurrency investor for the kidnapping and torture of an Italian national.

John Woeltz, 37, has been jailed since his arrest Friday outside the luxury rental, where the Italian national told police he was severely beaten, drugged, shocked with electrical wires and dangled over a ledge by captors seeking the password to his digital assets.

A search of the townhouse turned up cocaine, a saw, chicken wire, body armour, night vision goggles, ammunition and polaroid photos of the victim with a gun pointed to his head, according to prosecutors.

Woeltz’s alleged accomplice, William Duplessie, surrendered to police Tuesday and is awaiting his own indictment.

At the hearing Thursday, an attorney for Woeltz requested his client be released on a US$2-million bond, citing his lack of criminal record, philosophy degree and professional accomplishments.

“He’s been very successful in the technology world,” the attorney, Wayne Gosnell, told a Manhattan judge, adding that his client “has every intention to fight this case”.

The judge denied bail for Woeltz, who did not appear in court.

Gosnell also requested that Woeltz not be required to turn over firearms that he legally owns in Kentucky. And he disputed the prosecutor’s earlier claims that his client owned a private jet and helicopter.

“He has no means to flee,” Gosnell said.

Woeltz has described himself in interviews as a blockchain investor who spent time in Silicon Valley before returning to Kentucky’s burgeoning crypto-mining industry.

AP