Crypto Journalist

Amin Ayan

Crypto Journalist

Amin Ayan

About Author

Amin Ayan is a crypto journalist with over four years of experience in the industry. He has contributed to leading publications such as Cryptonews, Investing.com, 99Bitcoins, and 24/7 Wall St. He has…

Share

Last updated: 

June 7, 2025

A wave of violent kidnappings targeting cryptocurrency holders is pushing some of the industry’s most well-known figures to overhaul their security — including Didi Taihuttu, patriarch of the so-called “Bitcoin Family.”

Taihuttu, who famously sold everything in 2017 to go all-in on Bitcoin, revealed that his family has abandoned hardware wallets and now hides their crypto seed phrases across four continents.

The shift follows a string of threats and rising attacks on crypto holders worldwide.

Even at Gunpoint Attackers Would Get Little

“We have changed everything,” Taihuttu told CNBC from Thailand. “Even if someone held me at gunpoint, I can’t give them more than what’s on my phone wallet — and that’s not much.”

Over the past eight months, the family moved to a hybrid system: seed phrases are encrypted, split, and stored in both physical and digital formats.

Some parts are etched onto fireproof steel plates hidden across four continents. Others are stored via blockchain-based encryption services.

“You only need to remember which words you changed,” Taihuttu explained. The system ensures that even if attackers access part of the seed phrase, they cannot unlock the family’s full holdings.

The decision comes as physical attacks on crypto holders increase. Moroccan police this week arrested a suspect accused of kidnapping crypto executives.

In France, the father of a crypto millionaire was brutally attacked. And in New York, a tourist was tortured for over two weeks as kidnappers tried to extract his Bitcoin credentials.

The Taihuttus, who remain entirely unbanked and travel full-time with their three daughters, say they are rethinking even their public presence.

After strangers tracked their residence through YouTube videos, they stopped posting travel updates and moved homes.

“We got a little bit famous in a niche market — but that niche is becoming a big market now,” Taihuttu said, noting the family has decided to avoid traveling to France altogether.

About 65% of their crypto is now locked in cold storage across four continents. The rest remains in multi-signature wallets or decentralized exchanges for trading and daily spending.

Taihuttu said they avoid centralized vaults and services, preferring to retain full control.

“What happens if one of those companies goes bankrupt? You’re putting your capital back in someone else’s hands,” he said.

Crypto Executives Hire Bodyguards

As reported, crypto executives are turning to personal security services as targeted kidnappings and ransom attempts continue to escalate, particularly in France.

In May, private security firms such as Infinite Risks International, based in Amsterdam, reported a sharp increase in demand from crypto professionals seeking round-the-clock protection amid rising crypto kidnapping.

The rise in inquiries came a after spate of violent attacks, including multiple kidnappings attempts that have alarmed both investors and law enforcement.

A malicious Python package targeting Discord developers with remote access trojan (RAT) malware was spotted on the Python Package Index (PyPI) after more than three years.

Named “discordpydebug,” the package was masquerading as an error logger utility for developers working on Discord bots and was downloaded over 11,000 times since it was uploaded on March 21, 2022, even though it has no description or documentation.

Cybersecurity company Socket, which first spotted it, says the malware could be used to backdoor Discord developers’ systems and provide attackers with data theft and remote code execution capabilities.

“The package targeted developers who build or maintain Discord bots, typically indie developers, automation engineers, or small teams who might install such tools without extensive scrutiny,” Socket researchers said.

“Since PyPI doesn’t enforce deep security audits of uploaded packages, attackers often take advantage of this by using misleading descriptions, legitimate-sounding names, or even copying code from popular projects to appear trustworthy.”

Once installed, the malicious package transforms the device into a remote-controlled system that will execute instructions sent from an attacker-controlled command-and-control (C2) server.

The attackers could use the malware to gain unauthorized access to credentials and more (e.g., tokens, keys, and config files), steal data and monitor system activity without being detected, remotely execute code for deploying further malware payloads, and obtain information that can help them move laterally within the network.

​While the malware lacks persistence or privilege escalation mechanisms, it uses outbound HTTP polling instead of inbound connections, making it possible to bypass firewalls and security software, especially in loosely controlled development environments.

Once installed, the package silently connects to an attacker-controlled command-and-control (C2) server (backstabprotection.jamesx123.repl[.]co), sending a POST request with a “name” value to add the infected host to the attackers’ infrastructure.

The malware also includes functions to read from and write to files on the host machine using JSON operations when triggered by specific keywords from the C2 server, giving the threat actors visibility into sensitive data.

To mitigate the risk of installing backdoored malware from online code repositories, software developers should ensure that the packages they download and install come from the official author before installation, especially for popular ones, to avoid typosquatting.

Additionally, when using open-source libraries, they should review the code for suspicious or obfuscated functions and consider using security tools to detect and block malicious packages.