Police in South Korea have arrested four individuals in connection with the murder of a Chinese man in his thirties. Authorities say he had travelled to the island city of Jeju to complete a private crypto exchange.
Police discovered the body of the victim, identified only as Mr. A, on Monday afternoon after an acquaintance of the man telephoned 112 because they were concerned that he had not heard from Mr. A.
Mr. A was dead at the scene by the time officers from Jeju Western Police Station arrived at his hotel room. Police say he appears to have bled to death following multiple stab wounds.
His acquaintance had told police that the man “went to buy virtual currency,” but failed to contact him upon arrival at the hotel.
Police said they apprehended the first of the four suspects after one of them, a Chinese woman in her thirties, turned herself in at Seongsan Police Station in Jeju soon after the initial report.
The other three suspects, who are all Chinese nationals, were arrested by police at Jeju International Airport after attempting to leave South Korea.
Police report that the suspects were found with 85 million won (about $52,500) of the victim’s money, although officers are still investigating their specific motives and actions.
A worrying trend
This isn’t the first time that Chinese nationals have been arrested in Jeju in connection with thefts and cryptocurrency, with six individuals detained last month after stealing crypto worth 840 million won (or $585,000) from two other Chinese individuals.
In this earlier case, the suspects assaulted rather than murdered their victims, running off with the aforementioned cryptocurrency after previously agreeing to pay 1 billion won ($697,000) for it.
Such violent thefts of crypto have become increasingly common in recent years, according to a record of physical Bitcoin attacks kept by developer Jameson Lopp.
He has recorded 30 as having been reported in 2024, as well as 23 in 2023, 33 in 2022, and 36 in 2021.
This compares with 15 in 2020, eight in 2019, 26 in 2018, 12 in 2017, four in 2016, five in 2015 and only one in 2014 (although Lopp notes that his “list is not comprehensive; many attacks are not publicly reported”).
He has recorded ten so far in 2025 (not including the latest Jeju incident), raising the possibility that so-called ‘wrench attacks’ may become more common.
Explaining how these attacks took their name, AnchorWatch co-founder Becca Rubenfeld tells Decrypt that even the most advanced security precautions can be circumvented by the old-fashioned threat of violence.
“A thief, with ‘a wrench they paid $5 for,’ can scare you into giving up access to your Bitcoin or cryptocurrency,” she says. “The best plans can be thwarted by a gun to a victim’s head or the head of a loved one.”
Rubenfeld notes that AnchorWatch, which provides custody insurance backed by Lloyd’s of London, believes the trend of wrench attacks will “continue to accelerate,” with perpetrators attacking victims “even for relatively modest sums” of Bitcoin and other cryptocurrencies.
She says, “Owners have been kidnapped or attacked for the sake of tens of thousands or hundreds of thousands of dollars worth of cryptocurrency; you don’t have to own tens of millions worth to become a potential victim.”
Privacy is key
Jameson Lopp—who was himself the victim of a swatting attack in 2017—also suspects that forcible crypto thefts will become more frequent.
“This type of attack appears to be roughly correlated with the size of the market and overall adoption of crypto,” he tells Decrypt. “As adoption increases, more criminally minded actors are looking into how to apply their skills to target crypto owners.”
The most high-profile wrench attack to date was the kidnap of Ledger co-founder David Balland, who along with his wife was abducted from his home in France in January of this year and held captive for 24 hours, until the National Gendarmerie were able to free them.
Wrench attacks may not always be completely avoidable for individuals with a very high profile, yet for Lopp the average cryptocurrency owner can reduce their risk quite considerably.
He explains, “Avoiding this particularly high risk activity is quite simple: Don’t engage in face-to-face trades.”
This is precisely what happened with the latest Jeju incident, which Lopp describes as an example of “one of the more common forms of wrench attack,” in that it involved using the offer of a very lucrative trade to overcome the victim’s better judgment.
And for Rubenfeld, it’s also vitally important that crypto investors do not publicize their holdings.
She says, “The fewer people who know about your holdings, the less likely you will ever become a target.”
Edited by Stacy Elliott.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
