Trusted Editorial content, reviewed by leading industry experts and seasoned editors. Ad Disclosure

A court in Belgium has issued 12-year prison sentences to three individuals involved in the December 2024 kidnapping of the wife of a local cryptocurrency entrepreneur.

The case, which has drawn attention within both legal and crypto communities, centers on a ransom demand made in digital assets, highlighting the growing concerns about the intersection of financial technology and physical security.

Court Ruling and Ongoing Investigations

The Brussels Criminal Court found the trio guilty of hostage-taking after abducting the victim outside her residence and forcing her into a van. The kidnappers reportedly demanded a crypto ransom in exchange for her release.

Authorities acted swiftly after the woman’s husband, Stéphane Winkel, a known figure in the local crypto education scene, alerted law enforcement. Police intercepted the vehicle and executed a high-risk maneuver to halt it, freeing the victim and apprehending the suspects.

In addition to the prison terms, the court ordered the convicted individuals to pay a civil compensation of at least €1 million (approximately $1.2 million) to the victim. While the sentences mark the legal conclusion for the three kidnappers, the case remains open in some respects.

The court acknowledged that the principal figures behind the orchestration of the crime are still unknown. The defendants’ claims that they were acting under duress, allegedly threatened with death if they did not carry out the kidnapping, were dismissed by the court.

The case also involves a minor, whose role is being addressed separately through Belgium’s juvenile justice system. According to reports from La Dernière Heure, the court emphasized the seriousness of the offense and the need to maintain deterrence, particularly in criminal activities intersecting with emerging financial sectors like crypto.

The victim and her family have not been named in detail in court documents to protect their privacy, but the psychological toll has reportedly been substantial.

The Effect on Winkel Family and Crypto Community

Stéphane Winkel is known for his educational efforts within the cryptocurrency space. He runs platforms such as Crypto Académie and Crypto Sun, which aim to make digital asset investing more accessible to the public.

His YouTube channel, which has roughly over 39,000 subscribers, typically featured tutorials, giveaways, and wallet walkthroughs. However, the traumatic incident has prompted a shift in both his personal and public life.

In a post on X  published shortly after the incident, Winkel stated, “I consider myself a defender of freedom, but I now realize that safety must become an absolute priority for me and those around me.”

He also pledged to avoid public wallet demonstrations or promotional giveaways going forward, instead focusing his content on market analysis and education.

After several months of silence, Winkel returned to YouTube in June 2025, opting for voice-only narration in his videos rather than appearing on camera, a move that aligns with his new emphasis on privacy and security.

Featured image created with DALL-E, Chart from TradingView

Editorial Process for bitcoinist is centered on delivering thoroughly researched, accurate, and unbiased content. We uphold strict sourcing standards, and each page undergoes diligent review by our team of top technology experts and seasoned editors. This process ensures the integrity, relevance, and value of our content for our readers.

Scammers are impersonating the BianLian ransomware gang in fake ransom notes sent to US companies via snail mail through the United States Postal Service.

The fake ransom notes were first reported by Guidepoint Security today, with BleepingComputer later being sent a scan of the note from a CEO who received the same letter.

The envelopes for these ransom notes claim to be from the “BIANLIAN Group” and have a return address located in an office building in Boston, Massachusets:

BIANLIAN GROUP
24 FEDERAL ST, SUITE 100
BOSTON, MA 02110

In the letter shared with BleepingComputer, the envelope shows it was mailed on February 25th, 2025. This mailing date is the same as the one seen by Arctic Wolf, who also reported on the scam today.

The letters are being mailed to the CEO of the companies at their corporate mailing address and show that they were processed through a postal facility in Boston, with the envelope marked, “Time Sensitive Read Immediately.”

The envelopes contain a ransom note addressed to the company’s CEO or another executive, claiming to be from the BianLian ransomware operation. According to notes reviewed by BleepingComputer, they are tailored to the company’s industry, with different types of allegedly stolen data corresponding to the company’s activities.

For example, fake BianLian ransom notes sent to healthcare companies claim that patient and employee information was stolen, while those targeting product-based businesses allege the exposure of customer orders and employee data.

“I regret to inform you that we have gained access to [REDACTED] systems and over the past several weeks have exported thousands of data files, including customer order and contact information, employee information with IDs, SSNs, payroll reports, and other sensitive HR documents, company financial documents, legal documents, investor and shareholder information, invoices, and tax documents,” reads a fake BianLian ransom note.

The mailed ransom notes are very different from BianLian’s, but the scammers attempt to make them look convincing by including the real Tor data leak sites for the ransomware operation in the notes.

However, unlike typical ransomware demands, these fake notes state that BianLian is no longer negotiating with victims. Instead, the victim has 10 days to make a Bitcoin payment to prevent data from being leaked.

Each ransom note includes a ransom demand ranging between $250,000 and $500,000, a freshly generated Bitcoin address to send payment, and a QR code for the Bitcoin address.

Arctic Wolf said that all healthcare organizations had their ransom demand set to $350,000, which is the same as the one shared by a healthcare company with BleepingComputer, as shown below.

Furthermore, Arctic Wolf states that two ransom notes the researchers saw included legitimate compromised passwords to add legitimacy to the demand.

“In at least two letters, the threat actor included a compromised password within the How did this happen? section, almost certainly in an attempt to add legitimacy to their claim.” explained Arctic Wolf.

The consensus in the reports is that these ransom notes are fake and are only designed to scare executives into paying a ransom, as there are no signs of an actual breach.

“While GRIT cannot confirm the identity of the letter’s authors at this time, we assess with a high level of confidence that the extortion demands contained within are illegitimate and do not originate from the BianLian ransomware group,” explains GuidePoint Security researcher Grayson North.

However, this does not mean the emails should be ignored. Due to the widespread mailing of these notes, all IT and security admins should notify executives about the scam so that they are aware and do not waste time and resources worrying about them.

These fake ransom notes are an evolution of the email extortion scams that have become so popular since 2018. However, instead of targeting personal emails, they are now targeting the CEOs of corporations.

BleepingComputer contacted the BianLian ransomware operation to see if they were involved with these mailings, but a reply was not immediately available.