He was kidnapped for 30 hours in Bali to steal his crypto: the asset protection lesson

On the night of July 2, 2026, a 41 year old Russian national was intercepted outside his own restaurant in Uluwatu, Bali, by two masked men. He was held for roughly 30 hours, beaten, and coerced into handing over access to his cryptocurrency accounts. He was released on July 4, injured, in front of a hospital, without his assets. Bali police have not officially confirmed the stolen amount, though specialized outlets report figures near five million dollars. This is not an isolated anecdote. It is the physical version of a risk that international tax planning has treated for years as a mere account reporting problem.

According to Indonesia's state news agency Antara and specialized crypto outlets, the victim was leaving Hedonist, his restaurant in the Uluwatu area, around 9:35 p.m. when two attackers blocked his path with a vehicle. His phones were seized immediately, and he was taken to a villa holding devices linked to his crypto accounts, a detail suggesting the attackers already knew his holdings and routine before acting. He was released roughly 30 hours later in front of a university hospital nearby, beaten but alive. Police are investigating using CCTV footage and phone data, and no arrests had been announced at the time of writing.

The number that worries authorities is not one incident but a trend. According to France's Interior Minister Laurent Nuñez, that country alone logged 77 crypto related kidnappings and extortion attempts in the first half of 2026, already double the 45 cases recorded in all of 2025. Investigators call this pattern a "wrench attack": direct physical coercion against a person, with no need to breach any system, once someone's crypto wealth is known or easily inferred.

• Visible wealth: talking publicly, on social media or through your business about your crypto holdings, or a lifestyle that reveals wealth you cannot otherwise explain.
• Identifiable routine: living in one fixed, community known place, with predictable schedules and locations.
• Concentrated custody: holding all your private keys, or full access to your wealth, on a single device or with a single person, yourself, under duress.
• No legal structure: holding wealth in your own name, with no entities, trusts or jurisdictions separating title from immediate access.

The right response to events like this is not secrecy for its own sake, and certainly not hiding assets from a tax authority: CRS and the new CARF framework already make hiding income fragile, and illegal. The right response is a wealth architecture that spreads risk across several fronts at once.

1. Distributed, not concentrated, custody

No single person, not even you under duress, should be able to hand over one hundred percent of a wealth position with a single gesture. Splitting custody across mechanisms and locations limits what an attacker can demand in one night.

2. Holding through entities and trusts

Holding meaningful assets through an entity or trust, rather than personally, adds a layer of process between coercing a person and actually disposing of the asset. It also orders succession and litigation protection, not just kidnapping risk.

3. Public profile discretion

Separating your public identity from evidence of your wealth (business, social media, lifestyle) reduces the chance that someone identifies you as a target before ever approaching you.

4. Jurisdiction and residency as protection, not just tax savings

Where you live and where your structures sit is also a physical security decision: some jurisdictions have stronger institutions, better police cooperation and lower exposure for visibly wealthy foreigners.

Start with an honest read of your exposure: how much of your wealth is publicly inferable, how much custody depends on a single point of failure, and whether your current residency and structures were designed to protect you or only to lower your tax bill. Both matter, but solving only the tax side while leaving wealth security unresolved is, as this case shows, incomplete.

US persons: the same custody and structuring principles apply, on top of your existing FBAR and FATCA reporting duties, which do not disappear because a structure also protects you physically.

Frequently asked questions

This content is informational and educational. It is not legal or tax advice. Verify current regulations and consult a specialist about your case before making decisions.