The Spanish Civil Guard apprehended the unnamed suspect in Benalmádena, a town in the southern province of Málaga, following a large-scale operation deployed specifically because of the suspect’s reported dangerousness and ties to a broader criminal organization.
Over the course of more than a year as a fugitive, the suspect had moved between Valencia, Seville, and Cadiz, using rooms rented online and third-party bank cards to obscure his movements and avoid detection. A court in Fuengirola is currently processing a French extradition request under a European Arrest Warrant to return the suspect to France for trial, according to report by Wired.
What Happened in January 2025
David Balland, co-founder of hardware wallet manufacturer Ledger, and his wife were abducted from their home in central France on January 21, 2025. The kidnappers severed one of Balland’s fingers and sent video of the mutilation to a business partner to extort a ransom of €10 million, approximately $11.5 million, in Bitcoin. French elite tactical units from the GIGN rescued the couple within 48 hours of the abduction.
Most of the ransom that had been paid was subsequently traced, frozen, and seized by authorities. At least ten individuals were arrested in connection with the case in the immediate aftermath of the rescue, leaving only this final suspect unaccounted for until the Benalmádena arrest.
The Broader Context
The Balland kidnapping sits within a category of attacks that the security community refers to as wrench attacks, physical crimes targeting individuals known or believed to hold significant cryptocurrency wealth. The ransom demand denominated in Bitcoin reflects the perpetrators’ assumption that a Ledger co-founder would have immediate access to significant on-chain assets and the technical knowledge to execute a transfer under duress.
The cross-border nature of the investigation, spanning French law enforcement, Spanish Civil Guard operations across multiple cities, and a European Arrest Warrant mechanism, reflects the logistical complexity that crypto-targeted physical crimes increasingly require to prosecute fully. The suspect’s year-long evasion across Spain using cash-adjacent payment methods to rent accommodation demonstrates the operational awareness that organized groups targeting crypto figures have developed in avoiding digital financial trails while remaining physically mobile.
The arrest closes the investigative file on the Balland case. The extradition process and subsequent trial in France will determine the legal outcome for the final suspect alongside the ten already in custody.
