Ledger Co-Founder Rescued After Kidnapping, Severed Finger, and $10 Million Ransom Demand

Ledger co-founder David Balland — who has since left the company he helped build — was abducted along with his wife on January 21, 2025, in Vierzon, France, in an attack first surfaced on social media. Roughly ten assailants were involved, in what appears to have been a targeted, researched operation rather than an opportunistic crime.

The kidnappers demanded 100 BTC — about $10 million — for the couple's safe return. To prove they meant business, they severed one of Balland's fingers and sent it along with the ransom demand. According to Le Monde, the group coordinated through WhatsApp accounts traced to Southeast Asia, and Balland and his wife had already been split up by that point.

News of the kidnapping traveled quickly through crypto social circles, but much of the community deliberately withheld comment — a recognition, in cases like this, that public speculation can put victims at greater risk. Ledger CEO Pascal Gauthier later said the company's silence was intentional, meant to avoid interfering with the law-enforcement response. Some early reports also misidentified the victim, naming Éric Larchevêque rather than Balland.

While rumors circulated online, French investigators were already working the case on the ground — following a stolen car and a traced phone toward the perpetrators. To buy time and help track the kidnappers, investigators sent 1 BTC — about $105,000 — as part of the negotiation. GIGN, regarded as one of the world's elite special-forces units, deployed 230 operators across France in response.

The first break came in Châteauroux, where police located Balland alive, missing a finger but otherwise safe. His wife was found hours later, bound in the trunk of a car south of Paris. The 48-hour manhunt concluded with Balland's recovery on January 23. Seven suspects were subsequently arrested; prosecutors noted most were already known to police for prior offenses, though none had previous ties to organized gang activity.

Alongside the physical rescue effort, a parallel financial operation was taking shape. Nicolas Bacca, another Ledger co-founder, had been building a rapid-response framework specifically for crypto ransom scenarios. As he described it: "My goal was to create a system that could send freeze requests to all possible platforms within minutes, not hours. I worked to establish a process that could be triggered quickly and in a coordinated manner."

Once Balland was safe, that system was activated. Sarah Compani contributed her network of Tether and exchange contacts, the SEAL 911 rapid-response team joined the effort, and Tether CEO Paolo Ardoino personally helped expedite the process. Compliance procedures and documentation that would ordinarily take days or hours were compressed into minutes or seconds. The result, according to Gregory Raymond, was that roughly 95% of the ransom payment was frozen.

Asked to comment on the case, Bacca pointed to the randomness of the targeting: "David's only mistake was being friends with someone well-known in crypto. Given the size of our community, anyone can become a target. Crypto crime that crosses into the physical world is a guaranteed way to get rekt."

This case fits a broader pattern rekt had already flagged in its earlier "Digital Danger" investigation, which tracked a growing number of physical attacks tied to crypto wealth. In the month before Balland's abduction, at least three comparable incidents occurred elsewhere in Europe:

• In Saint-Genis-Puilly, a 56-year-old father was beaten and bound during a home invasion, his wife also restrained, before he was driven roughly 500 km away. Police eventually found him doused in gasoline inside a car trunk near a gas station outside Le Mans, while his son — a Dubai-based crypto influencer — had been receiving ransom demands.
• In Troyes, a 30-year-old crypto entrepreneur was lured to what he believed was a business meeting on Rue Lamartine, where four kidnappers demanded €20,000 for his release.
• In Belgium, the wife of a crypto millionaire was pulled into a French-registered van in broad daylight, and was rescued only after a police helicopter pursuit ended in a highway takedown near Bruges.

Balland had, in 2020, posted a photo of his new house online — an ordinary display of success at the time that may, in retrospect, have marked him as a target for those watching from the shadows.

Balland has met the aftermath with dark humor: his X profile now reads "Kidnapping Championship 2025 - Ledger co-founder - Fingers: 9/10." Behind the joke, though, sits a more sobering reality — that no amount of cryptographic security protects against a physical threat, and that the operational-security choices some founders make around their public identities may increasingly function as protection against more than just hackers.