People like to say that nobody pays ransoms, but that is always a pose, as I’ve already written here (in French). The video immediately led investigators, and the two negotiators handling the case, to judge the kidnappers determined. So permission was given to make a payment from day one.
At this stage, the investigation has not yet established why this target was chosen, but the crypto ransom demand says something about the motives. Perhaps they believed it would all stay anonymous and that they wouldn’t even need to launder the funds.
Except that… whatever you think of Ledger or of crypto, its founders are exceptionally bright, clever people and experts in their field. Notably Nicolas Bacca, who is nobody’s fool.
Larchevêque was willing to contribute, but had no cash available at short notice. A senior Ledger executive agreed to send 400 ETH (€1.2M) to calm the kidnappers. Several further transfers followed, to obtain proof of life, for a total of nearly €3M, according to someone close to the case, a figure confirmed by others19.
But Bacca was asking himself another question: how to make sure the funds were sent… but could still be frozen. Which he explained at length to The Big Whale:20
“My goal was to build a system ready to be triggered to send freeze requests simultaneously to every possible platform within minutes, not hours.”
A team formed around Bacca and Sarah Compani of Aleph Avocats21. While the firm isn’t exactly a leading name in criminal law, its lawyers (all 3 partners are women) have advised several crypto players, notably on PSAN registration, and counsel Consensys… and Tether, whose boss Paolo Ardoino would step in personally. The SEAL 911 community of Security Alliance joined in, and many of the exchanges were looped in. Several blockchain experts, including a former SushiSwap developer, backed Bacca up in a Telegram group.
By Tuesday evening, one of the kidnappers’ wallets had been blacklisted by USDT2223.
Once the 400 ETH had been received, almost all of it was swapped into USDT via TrustWallet, a fully decentralised platform with no KYC. 210K USDT then went to KuCoin, 112K USDT to Binance, and 640K to another wallet.
Compani, who had been alerted in advance by Bacca, then asked the platforms to freeze the funds. According to a compliance specialist, given the amounts, there was little chance it would get through.
“KuCoin and Binance are platforms with KYC. Either they’re really stupid, or they really know nothing about crypto. Or else they’re very smart and managed to hack accounts that aren’t in their name.”
Within a few hours, all these funds were frozen and the masterminds, who were extremely active, could no longer move anything. Part of the funds was then converted into Solana, via MEXC and FexFloat24. 250 SOL were frozen again very quickly, thanks to Compani’s work, in direct contact with the prosecutor, who fired off requisition orders to the platforms one after another.
Only 40 ETH (€122K) could be cashed out, to a wallet whose activity appears indirectly to be located in Morocco. As for the frozen funds, they have for now been seized by the courts as part of the investigation.
Last year, Tether had already frozen funds stolen in an exploit targeting Ledger25.