World's Most Dangerous Countries for Crypto Millionaires in 2026

A Ledger co-founder gets his finger cut off in rural France. A family in Chicago is held hostage until they transfer $15 million. A man in Hong Kong brings five million euros in cash to a hotel room and gets slashed with a knife. A teenager in Los Angeles has his crypto stolen by an LAPD officer working with the Israeli mob.

These aren't hypothetical scenarios. They're entries in a growing database of real attacks against people who hold cryptocurrency. And the database is getting longer fast.

We wanted to answer what seems like a simple question: where in the world is it most dangerous to be a crypto holder? The obvious answer is the United States, which leads with 53 documented attacks, followed by France with 40 and the UK with 21. But that ranking is misleading. The US also has 53 million crypto owners. France has 3 million. Hong Kong has 181,000.

When you adjust for the size of each country's crypto population, the picture changes completely. Some countries that barely register in raw attack counts turn out to have alarming rates of violence per crypto holder. Others that dominate the headlines are, statistically, not that dangerous at all.

This is our attempt to build that adjusted ranking, and to explain what it actually means for people making decisions about where to live.

How we did this

We pulled attack data from Jameson Lopp's open-source repository of physical Bitcoin attacks, which has been tracking every publicly reported case of robbery, kidnapping, torture, and murder targeting crypto holders since 2014. The dataset contains 307 incidents across 53 countries through March 2026. Lopp, who was himself swatted in 2017, maintains it as a community resource. It's the most complete record that exists, though it comes with an obvious caveat: plenty of attacks never make the news, especially in countries without a free press or where victims fear retaliation. The true numbers are higher than what we're working with here, and the undercount is probably worse in places like Pakistan, Nigeria, and China than it is in London or New York.

For ownership data, we used Triple-A's crypto ownership estimates aggregated by World Population Review, which estimate how many people in each country hold cryptocurrency as of 2023.

The math is simple. We divided the number of attacks in each country by the number of crypto owners and multiplied by one million. That gives us a rate: attacks per million crypto owners.

A few things this approach can't capture. The ownership data is from 2023 but the attacks span 2014-2026. Attacks on tourists count against the country they were visiting, not their home country (Thailand's numbers are inflated by this). And the ownership figures treat every crypto holder equally when the real targets are wealthy or publicly visible ones, which is a much smaller group. We're aware of these gaps. The ranking is still more useful than raw counts.

---

The full ranking

All 53 countries with at least one documented physical crypto attack, ordered by attacks per million crypto owners.

---

Country by country

1. Iceland (275.8 per million)

A quirk of the math. Iceland has one documented attack: the "Big Bitcoin Heist" of December 2017, where about 600 mining rigs were stolen from data centers. It was a hardware theft, not a violent attack on an individual, and the perpetrators were caught. But Iceland only has about 3,600 crypto owners, so that single incident produces a rate of 276 per million.

Don't read anything into this. Iceland is safe. The ranking artifact is the price you pay for including every country with at least one incident.

2. Malta (181.7 per million)

One attack, 5,500 crypto owners. Malta tried to become "Blockchain Island" in 2018 with friendly crypto legislation. The single recorded incident involved a victim watching $700,000 disappear during what he thought was a routine transaction. Same statistical distortion as Iceland. Malta's small, tight-knit community does mean that wealthy holders are more visible than they'd be in a bigger country, but one incident doesn't make a pattern.

3. Montenegro (138.1 per million)

In November 2023, Binance client executives were invited to Montenegro for what they thought was a business trip. They were kidnapped. Their attackers forced them to empty wallets worth $12 million in USDT. With 7,200 crypto owners in the country, this one case sends the rate to 138.

The lesson here isn't about Montenegro specifically. It's about accepting meeting invitations from people you don't know, in places you're not familiar with.

4. Hong Kong (66.3 per million)

This is where the ranking starts telling you something real. Twelve attacks against 181,000 crypto owners. The rate is 66.3 per million, the highest of any place with a meaningful sample size.

The pattern is almost always the same: someone arranges a face-to-face crypto trade, shows up with cash or expecting cash, and gets jumped. Victims have been beaten with sticks, blinded, slashed with knives. In one case, beaten with hammers by Triad members. The most recent incident, March 2026, involved a Turkish man who brought a bag with five million euros in cash to a hotel in Tsim Sha Tsui.

Something about Hong Kong's in-person trading culture keeps producing these outcomes. The dense urban layout. The enormous sums changing hands. The apparent willingness of traders to walk into hotel rooms carrying briefcases of cash. If you're doing OTC trades in Hong Kong, you are gambling with your physical safety in a way the data makes hard to ignore.

5-7. Cyprus, Estonia, Latvia

One attack each, small crypto populations, high rates. Cyprus (64.9), Estonia (48.6), Latvia (42.0). These are popular residency destinations for tax optimization. The incidents were isolated. Worth flagging only because wealth is more visible in small communities, and these countries attract a disproportionate share of crypto-rich relocators.

8. Sweden (35.3 per million)

Six attacks, 170,000 owners. The Swedish cases are nasty. Home invasions where families get tied up and beaten. A man taken into the woods, doused in gasoline, threatened with being set on fire. A farming family robbed of millions in September 2025.

There's an uncomfortable irony here. Sweden is broadly one of the safest countries on earth. But it also has some of the most transparent public records in Europe. Tax filings, property ownership, even income data is accessible. If you're a crypto holder in Sweden and your wealth has ever touched the traditional financial system, you're more identifiable to criminals than you would be in most other places. Several of the Swedish attacks show signs of pre-attack surveillance. These weren't random.

9. Norway (31.4 per million)

Two attacks, both memorable. In 2019, a Bitcoin millionaire escaped home invaders by jumping off his balcony. In August 2025, robbers dressed as food delivery workers tied up a family with three children in Oslo and threatened to shoot the mother. Nine people were later charged.

Same dynamic as Sweden: transparent society, small crypto community, visible wealth. The fake-delivery-driver tactic has now been used in Norway, France, the US, and several other countries. It works because people open their doors.

10. Lithuania (29.9 per million)

A single 2016 incident. A crypto executive was kidnapped at a car wash in Kaunas. Lithuania has since become a fintech hub with no repeat incidents. This appears to have been a one-off.

11. Austria (25.0 per million)

Three attacks. Two in Wels, where victims were robbed by men posing as postmen in 2018 and 2019. Then, in November 2025, a case from Vienna that belongs in a different category entirely: a university student betrayed a classmate (the son of Kharkiv's mayor), tortured him, and burned him to death to get access to his crypto wallets. That case was interpersonal violence rather than organized crime, but it's in the dataset and it's real.

12. Paraguay (23.5 per million)

Both attacks targeted Bitcoin mining facilities, which have multiplied in Paraguay because of cheap hydroelectric power. In November 2025, an armed assault on a mining facility left both the owner and one attacker dead. In May 2025, three Chinese nationals who'd entered the country illegally tried to rob a different facility and ended up in a shootout with police. If you run a mining operation in Paraguay, your physical security setup needs to match the value of your hardware.

13-16. Georgia, Belgium, Israel, New Zealand

Rates between 14.9 and 22.5. Belgium had a home invasion in January 2022 targeting a teacher with 3 million euros in BTC, and then a January 2026 invasion of a doctor who didn't even own any crypto. Israel saw an armed home invasion in September 2025 where the victim was stabbed and lost nearly $600,000. New Zealand's 2021 case involved thieves physically ripping a safe containing $4 million in crypto out of a house. The family later offered a $500,000 reward.

17. Netherlands (14.3 per million)

Seven attacks spread from 2015 through 2021. ATM thefts, men posing as service technicians, armed home invasions of crypto personalities. The attack on TV host Vincent Everts, threatened during a livestream in December 2021, is probably the most widely known Dutch case. The Netherlands' open society and strong media reporting likely mean these incidents are better documented here than in many other countries with similar or lower rates.

18. France (13.1 per million / 40 attacks)

France needs its own section because what's happening there right now has no precedent anywhere in the world.

The current wave started with the January 2025 kidnapping of Ledger co-founder David Balland. His wife was also taken. His finger was severed. GIGN, the elite tactical unit, rescued them both. That should have been the wake-up call. Instead, it was the beginning.

In May 2025, three incidents hit in quick succession. The father of a crypto millionaire was kidnapped and lost a finger (rescued by GIGN, again). The daughter of a crypto exchange CEO was nearly snatched off the street in Paris, in broad daylight, saved only because her partner and bystanders fought the attackers off. Days later, police arrested ten men in balaclavas outside a crypto entrepreneur's home in Nantes.

By January 2026, it was multiple attacks per week. Seven incidents in that month alone, scattered from Dijon to Sallanches to the Paris suburbs. The targets had shifted from crypto holders themselves to their families. Parents, spouses, children, siblings. In one case, the attackers hit the wrong address entirely and beat up a woman who had nothing to do with crypto.

Why France? A few things feed into each other. French tax and property records are relatively easy to search, which helps criminals identify targets. The country sits at a crossroads of organized crime networks from North Africa and Eastern Europe. And the French crypto community is concentrated and socially connected enough that once criminals compromise one person's network, they can map out the next several targets.

The French government has assigned police protection to some prominent crypto figures. It's not enough. If you're a crypto holder with meaningful wealth considering France as a home base, the data as of March 2026 says: don't.

19. Costa Rica (10.8 per million)

One attack. In August 2024, eight men (possibly police officers) robbed 11 Israeli tourists of over 10 BTC in Puntarenas. This was about tourists being targeted, not residents. Costa Rica remains popular with crypto expats, and the isolation of some communities there cuts both ways: fewer prying eyes, but also fewer cops if things go sideways.

20-22. Bulgaria, Canada, United Kingdom

Bulgaria (6.7) had one case: fake police demanding 14 Bitcoin from a victim they'd snatched. They failed and were caught months later.

Canada (6.3) has had 17 attacks and they keep getting worse. Crypto influencer Kevin Mirshahi was beaten to death in a Montreal torture room in June 2024. WonderFi CEO Dean Skurka was kidnapped during rush hour in Toronto in November 2024 and released only after a $1 million ransom was paid. In August 2024, attackers invaded a home in Verdun, Quebec and tortured the victim for hours until he transferred $15,000. A violent home invasion in Port Moody, British Columbia led to a 7-year sentence. The geographic spread across Montreal, Toronto, Vancouver, and smaller cities tells you something: criminal networks across the country have figured out that crypto people are worth targeting, and they're acting on it from coast to coast.

The UK (5.4) has 21 attacks, mostly in England. The June 2024 London case where three men with machetes invaded a home and took over 1,000 ETH. The May 2025 drugging of an American tourist by a fake Uber driver. And then there's Karl Johnson from Salford, who was attacked four separate times between early 2023 and late 2024. Knocked on by strangers, threatened with knives, kidnapped, held overnight in a cupboard, kidnapped again days later. His case is an extreme illustration of something the data shows more broadly: once you've been hit, you become a known target.

23. Spain (4.8 per million)

Seven attacks. Spain has become a secondary theater for crypto crime in Europe, though at a much lower intensity than France. The incidents are spread across the country: a 2023 kidnapping in Barcelona where five men stormed a crypto company office with tasers and zip ties, a businessman held for a million-euro ransom in Benalmadena, and the March 2026 kidnapping of a Canadian crypto millionaire on a fashionable Madrid street by three Serbian men. The Costa del Sol, long associated with expat wealth and organized crime, has seen multiple incidents. A crypto trader randomly told men he'd met at a hotel what he did for a living. They later invited him over, took him hostage, and demanded 30,000 euros. He managed to alert a friend, who called police.

24. Singapore (4.5 per million)

Three attacks in one of the world's safest cities. The biggest was a $3 million robbery of 11 suspected Chinese crypto gamblers in April 2024, which felt less like a crypto attack and more like a heist movie. A 19-year-old who tried to do a peer-to-peer cash-for-USDT trade got punched but managed to escape. That Singapore is on this list at all is worth sitting with. No amount of low crime rates makes you immune if you're meeting strangers to trade large sums of crypto.

25. Australia (4.1 per million)

Three incidents. The most memorable: a TikTok influencer in Melbourne lured a Saudi royal to her luxury flat and had him imprisoned until he handed over $40K in Bitcoin in February 2023. A crypto ATM was stolen from a Melbourne shopping center in December 2024. And a gang kidnapped a couple in Sydney, held the boyfriend for six days, tortured him, and demanded $5 million in ransom. Few cases, but creative ones.

26. UAE (3.5 per million)

Dubai markets itself as a crypto paradise. It has 10 documented attacks, and many follow the exact same script: show up for an in-person Bitcoin trade, get robbed.

In one case, attackers sprayed deodorant in a victim's face. In another, nine men invaded a trader's office and took over $1 million. A driver and his friends lured an investor into a fake deal, robbed her, electrocuted her, and took blackmail videos. In October 2025, a Russian crypto scammer was kidnapped, tortured, murdered, and dismembered by other Russians when ransom demands weren't met.

The problem with Dubai is that it concentrates crypto wealth in a small, visible geography full of transient people. Everybody's new, nobody has deep roots, and there's a steady flow of high-value OTC trades happening between strangers. The low tax rate attracts money. The money attracts criminals. And the transient population means attackers can disappear quickly. Several Dubai cases involved perpetrators who had flown in from other countries, committed the robbery, and left.

There's a specific Dubai pattern worth understanding: someone advertises a large BTC purchase, arranges a meeting at an office or apartment, and shows up with multiple accomplices. The "buyer" was never a buyer. If you're doing face-to-face trades in Dubai, you're playing a game where the other side may already know the outcome.

27-29. Romania, Sri Lanka, South Korea

South Korea (2.4) is the one to watch here. Five attacks, and the pattern has shifted recently. The March 2023 Seoul case was gruesome: four men kidnapped a 48-year-old woman, stole her crypto, and killed her. But the newer incidents look different. In early 2025, Chinese suspects stabbed a man in a Jeju City hotel room during a fake trade. Russian nationals tried to rob another victim in a Seoul hotel in May 2025. Foreigners are flying into South Korea specifically to target crypto holders, which tells you the country's active OTC trading scene has attracted international attention from the wrong kind of people.

Romania (3.0) had a single violent case: a restaurant owner in Cluj was kidnapped, doused in diesel, force-fed alcohol, and had a finger cut off before transferring $200,000. Sri Lanka (2.4) recorded one case of Chinese nationals kidnapping a man and extorting 60,000 USDT. Both single incidents, but both brutal enough to remember.

30. Thailand (2.3 per million / 16 attacks)

Thailand's rate looks moderate at 2.3, but that's because 7 million Thais own crypto. The raw count of 16 attacks makes it the fifth most targeted country in the world, and most of those attacks target foreigners.

Phuket is the epicenter. At least six separate attacks have occurred on the island, enough to call it the single most dangerous specific location for crypto holders to visit. Russian-speaking criminal networks operate there and have kidnapped and extorted multiple victims in hotel rooms. Bangkok adds to the count with OTC trade ambushes in parking garages.

The pattern usually involves social engineering. Someone meets the victim recently, learns about their crypto, and sets up a meeting that turns into a trap. If you're spending time in Thailand and people you've just met seem unusually interested in your finances, that should set off alarms.

31. Ukraine (2.3 per million)

Nine attacks spanning 2017-2025. The distinctive feature here is corrupt law enforcement. In one case, police kidnapped a businessman, tortured him in a forest, and forced his wife to send 7 Bitcoin. In October 2025, men in military uniforms held a victim in a basement until he transferred 83,000 USDT. The ongoing war has put more weapons in circulation and stretched police capacity thin.

32-36. Malaysia, Taiwan, Uganda, Italy, Ghana

One to two attacks each, rates between 1.3 and 2.0. Malaysia's cases targeted mining operations. Uganda's May 2025 case, where a crypto founder was abducted and forced to transfer $500,000, is a reminder that these attacks are spreading geographically. Italy had a knife attack on a broker and a counterfeit-money Bitcoin buy gone wrong.

37. Russia (1.1 per million)

Ten attacks across a huge country. A blogger beaten and robbed after boasting about crypto wealth online. Armed robberies of mining facilities. GPU warehouses raided by masked men. And a traffic cop in Ufa who spent 2022 robbing Bitcoin from people he pulled over, taking 20 million rubles before he was caught and jailed. Russia's 8.7 million crypto owners bring the rate down, but a traffic cop shaking people down for Bitcoin at routine stops is a level of brazenness you don't see in many other countries.

38. United States (1.0 per million / 53 attacks)

Fifty-three attacks. Number one in the world by raw count, by a wide margin. But 53 million crypto owners put the per-capita rate at just 1.0, which lands the US at 38th.

The variety is what stands out. Swatting attacks on developers. Armed suburban home invasions. Fake FBI agents in Porsches. Teens who flew from Florida to Oregon to kidnap someone and torture them for a seed phrase. An LAPD officer teaming up with Israeli gangsters to rob a 17-year-old. A delivery-worker costume as cover for an $11 million San Francisco heist. The Amouranth case, where the streamer posted a $20 million wallet screenshot and was invaded shortly after (her husband shot one of the attackers).

Two trends stand out in the US data. First, social engineering at the front door: criminals increasingly pose as delivery workers, construction crews, police officers, or Uber drivers to get within arm's reach of victims. Second, targets are getting younger. A 13-year-old had his dog stolen after rug-pulling a memecoin. Multiple teens have been targeted for SIM-swap proceeds.

The US arrests and prosecutes attackers at a higher rate than most countries on this list. The six men from the Chicago case all face federal charges. The fake DoorDash trio in Texas got caught the same night. The LAPD officer is in custody. Whether that actually deters anyone is debatable. The pace of incidents picked up in 2024 and hasn't slowed.

One thing the US data makes clear: the attacks are getting more sophisticated. Early cases were often opportunistic, a robbery during a Bitcoin sale gone wrong. Recent ones involve weeks of planning, rented vehicles, surveillance, costumes, and teams of five or more people. The November 2025 San Francisco case, where a single attacker posing as a delivery worker walked away with $11 million, shows that even one skilled operator can cause catastrophic losses if the target isn't prepared.

39-43. Poland, Colombia, Argentina, Turkey, Japan

All below 1.0 per million. Argentina's most memorable case: a crypto trader in Villa Carlos Paz met a woman on Tinder in September 2024, was likely drugged, then beaten by a group of men and murdered. Japan has two early cases. Turkey's involved a gang posing as police. Poland had one shooting at a Bitcoin exchange in 2021. Low frequency. But tell that to the guy who got drugged on a Tinder date in Argentina.

44-48. Indonesia, Philippines, Pakistan, Brazil, Nigeria

These countries have massive crypto populations that push their rates below 0.35. But the raw numbers tell a different story.

Brazil has had eight attacks. A construction worker who overheard his client mention Bitcoin investments passed the information to a gang, who then invaded her home and took everything. The Philippines had five, including the March 2025 murder of Anson Que, whose family paid over $3 million in ransom and got his body back anyway. Pakistan has had five, with several involving police officers.

A crypto millionaire in Sao Paulo or Manila or Karachi faces real danger. The rate looks low because these countries each have tens of millions of crypto holders, most of whom hold small amounts and will never be targeted. The subset of wealthy, visible holders faces much higher odds than the national average suggests.

49-53. Germany, South Africa, India, Vietnam, China

The bottom of the list. And the bottom is misleading.

India has 93 million crypto owners and 12 attacks, producing a rate of 0.13. The attacks include: police in Gujarat kidnapping a businessman and extorting 200 BTC from him, a gang in Rajasthan abducting three traders and demanding 80 BTC in ransom, and a group of five constables in Jodhpur who kidnapped two men and extorted them with threats of false criminal charges. Several Indian cases involve law enforcement as the perpetrators. Twelve attacks is not trivial. It just looks trivial next to 93 million owners.

China has two documented attacks and 59 million owners (rate: 0.03). The real number of attacks is almost certainly higher. China effectively banned crypto trading in 2021, pushing the market underground. Underground markets don't generate police reports. One of the two documented cases, a man in Chengdu lured by an X account promising sex and then ambushed by a gang, only made the news because of the unusual setup.

Germany's single attack, a robbery during a face-to-face trade in Munich in 2021, gives it a rate of 0.21. For a country with nearly 5 million crypto owners, that's remarkably low. German privacy norms and strict data protection laws may actually help here.

South Africa (0.17) and Vietnam (0.10) round out the bottom with one and two attacks respectively. Vietnam's cases, both in Ho Chi Minh City, involved organized Chinese gangs. South Africa's single documented case probably understates the reality given the country's general crime rates, but we can only work with what's been reported.

---

What all of this means

If you only look at raw attack counts, the US and France dominate. If you adjust for crypto population size, small European countries with a handful of incidents produce the scariest-looking rates. Neither view tells the full story on its own.

The useful signal is in the middle of the table. Hong Kong, at rank 4, has both a high rate and a high enough attack count to trust the pattern. Sweden and Norway, at ranks 8 and 9, show that transparent Scandinavian societies carry a specific kind of risk for wealthy crypto holders. France, at rank 18 by rate but rank 2 by count, is experiencing something no other country has gone through.

A few things are true everywhere.

In-person crypto trades are the single most common setup for an attack. Hong Kong, Dubai, Bangkok, Singapore, South Korea. The story repeats: someone shows up to trade, someone else shows up to take. If this report convinces one person to stop doing face-to-face crypto deals with strangers, it'll have been worth writing.

Wealth that's visible is what gets people targeted. Swedish tax records. French property databases. Instagram posts. A casual comment to a construction worker in Sao Paulo. A screenshot of a wallet balance on Twitter. The attackers in this dataset almost never pick random victims. They know, or think they know, what you have before they come for you.

The trend line is bad and accelerating. The dataset logged 74 attacks in 2025, more than double the previous year. The first three months of 2026 are on pace to match or exceed that. When Bitcoin was at $300, nobody was getting kidnapped for their private keys. At $100,000+, it's a different calculation for a different kind of criminal. The physical threat to crypto holders is growing faster than most people in the industry seem to realize, and it will keep growing as long as prices stay high and operational security stays lax.

---

This report was produced by CitizenX Research using publicly available attack data from Jameson Lopp's physical-bitcoin-attacks repository and crypto ownership estimates from Triple-A / World Population Review. For questions or to report an attack not in the dataset, contact [email protected].