Spain’s Civil Guard has detained a suspect in the southern town of Benalmádena, in the province of Málaga, in connection with the kidnapping and torture of Ledger co-founder David Balland. The arrest was carried out under a European arrest warrant issued by France, marking a significant cross-border development in one of Europe’s most prominent crypto-linked abduction cases. The suspect is accused of participating in an attack in which the perpetrators demanded a ransom of 10 million euros, equivalent to approximately $11.5 million.
Balland was taken from his home in central France on January 21, 2025, and held captive until a police operation secured his release the following night. French authorities had previously identified and arrested other individuals involved in the attack, but this suspect allegedly fled to Spain to avoid capture. The Civil Guard described the arrest as the latest step in a coordinated investigation between French and Spanish law enforcement.
Investigators initially tracked the suspect to the province of Valencia, where he had been living with a partner and a friend. The group maintained a low profile, renting apartments through online platforms and using a third party’s bank card to avoid leaving a financial trail. The suspect subsequently moved through Seville and Cádiz before authorities located and arrested him in Benalmádena.
The Civil Guard noted that the arrest, transfer, and detention required a large-scale police operation, citing the suspect’s perceived dangerousness and concerns that associates within the criminal network could attempt to intervene. The operation reflects the complexity of pursuing suspects who move across national borders and take deliberate steps to conceal their whereabouts. Authorities did not disclose further details about the suspect’s identity.
The Balland case is part of a broader pattern of crypto-linked attacks recorded in France during 2025. In June of that year, French authorities charged 25 suspects in connection with a series of kidnappings and attempted kidnappings targeting cryptocurrency executives and investors. That same month, a separate crypto user was abducted and held for several hours, with attackers demanding cash and access to a hardware wallet containing an undisclosed sum.
Earlier in 2025, the daughter and grandson of Pierre Noizat, chief executive of French crypto exchange Paymium, were targeted in an attempted abduction. The victims managed to fight back and escape without being taken. The series of incidents has drawn attention to the physical security risks faced by individuals publicly associated with significant cryptocurrency holdings or prominent roles in the industry.
Originally reported by CoinTelegraph.
