Executive Summary
In a cross‑border effort this week, Binance Security teamed up with independent crypto investigator ZachXBT to seize roughly $800,000 of a $2 million ransom that was paid to French livestreamer known as “TeufeurS.” The frozen assets represent about 40 % of the total sum paid after the streamer’s father was abducted in Sarthe, France, in 2023.
The operation marks one of the few instances where a major exchange and a private investigator have jointly disrupted a crypto‑ransom scheme linked to a kidnapping. While the remaining funds are still unaccounted for, the freeze sends a clear signal that illicit crypto transfers can be tracked and intercepted.
What Happened
According to statements from Binance Security, the team identified a series of wallet addresses that received the ransom proceeds shortly after the payment was made. Using on‑chain analytics, ZachXBT traced the flow of funds to a cluster of accounts that appeared to be under the control of the perpetrators.
When the suspicious activity was confirmed, Binance’s security unit placed a hold on the targeted wallets, effectively immobilising the assets. The freeze was executed without the need for a court order, leveraging Binance’s internal compliance mechanisms and its ability to lock funds on its platform.
The seized amount totals approximately $800,000, which aligns with the 40 % share reported by the investigators. The remaining $1.2 million continues to circulate across multiple exchanges and mixers, complicating further recovery efforts.
Background / Context
The ransom originated from a kidnapping that unfolded in the Sarthe department of western France in 2023. The victim, the father of TeufeurS, a popular French livestreamer, was seized by a group that demanded payment in cryptocurrency, a method increasingly favoured by criminals for its perceived anonymity.
TeufeurS, whose real name has not been disclosed for safety reasons, complied with the demand to secure his father’s release. The payment was routed through a chain of crypto wallets before landing on the exchange accounts now under investigation.
Crypto‑ransom plots have risen in Europe over the past few years, exploiting the speed and borderless nature of digital assets. This case is notable because the target was a high‑profile content creator, highlighting how personal notoriety can make individuals and their families vulnerable to sophisticated extortion schemes.
Reactions
ZachXBT, who has built a reputation for tracking illicit crypto flows, praised Binance’s rapid response. He noted that the collaboration demonstrates how private expertise can augment the capabilities of large exchanges when confronting financially motivated crime.
Binance Security issued a brief comment confirming the freeze and emphasizing the platform’s commitment to cooperate with investigators worldwide. French law‑enforcement officials, while not providing detailed remarks, acknowledged the assistance from the private sector in disrupting the ransom network.
What It Means
The successful freeze underscores the growing effectiveness of on‑chain forensic tools when paired with exchange‑level controls. It also illustrates that crypto‑ransom demands are not immune to disruption, even when victims are forced into paying large sums.
For regulators and law‑enforcement agencies, the case offers a template for public‑private partnerships that can accelerate the identification and immobilisation of illicit proceeds. As crypto adoption expands, such collaborations may become a cornerstone of broader strategies to curb financially motivated cybercrime.