Lamborghini Bitcoin carjacking puts crypto’s wrench-attack crisis in a US courtroom

A Missouri man has pleaded guilty in Hartford federal court to a robbery conspiracy tied to an attempted Bitcoin theft, a Lamborghini Urus carjacking, and the kidnapping of two people in Danbury, Connecticut.

Saif Faiq, 22, of St. Louis, pleaded guilty on June 8 to conspiracy to interfere with commerce by robbery. Prosecutors said the case stemmed from an August 2024 plan to steal Bitcoin from a family connected to a separate theft involving hundreds of millions of dollars in BTC.

The charge carries a statutory maximum of 20 years in prison, and Faiq is scheduled to be sentenced on August 28.

Prosecutors said the kidnapping victims were the parents of an individual who participated in the Bitcoin theft, and that Faiq helped recruit participants, coordinate with Adam Iza, and conduct surveillance on the victims.

The Danbury case is another example of the growing physical threat around crypto wealth. Prosecutors tied the plea to relatives, surveillance, a luxury vehicle, and an alleged attempt to reach Bitcoin through human leverage.

Prior CryptoSlate coverage has shown a stark increase in identity exposure and family targeting in France. The Danbury record shows a similar threat now surfacing in a U.S. federal case.

A US court record for a physical crypto threat

In September 2024, prosecutors charged six Florida residents after Danbury police responded to a carjacking and kidnapping involving a Lamborghini Urus. According to that release, the victims were forced from the vehicle and bound in a van before police intercepted the alleged kidnappers.

DOJ's June 2026 releases state that six other individuals charged in connection with the carjacking and kidnapping have all pleaded guilty.

Faiq is not the only alleged coordinator whose case has reached the plea stage. Adam Iza, identified by DOJ as Faiq's brother, pleaded guilty on June 1 to the same Hobbs Act robbery conspiracy charge related to the attempted Bitcoin robbery and Danbury kidnapping.

Prosecutors said Iza communicated with some of the kidnappers through cellphone and encrypted messaging apps, directed logistics, and provided funding.

The federal case is built around familiar violent-crime allegations: recruitment, funding, surveillance, carjacking, kidnapping, and robbery conspiracy. The crypto link comes from the alleged attempt to force access to Bitcoin through people close to the suspected holder.

The plea puts crypto-linked physical coercion inside a U.S. federal violent-crime case.

For holders, the practical warning is blunt: perceived access to Bitcoin can make family members, vehicles, addresses, or public wealth signals part of a criminal target list.

The same pressure point appears across the wider wrench-attack record.

The Lamborghini detail matters because it is a visible wealth signal in a case prosecutors now connect to an attempted Bitcoin robbery.

In that context, a familiar luxury image becomes a security warning about assumptions, proximity, and access.

The attack surface is the person

Security researchers use the term wrench attack for physical coercion that forces a victim to surrender passwords, private keys, or access to digital assets.

CertiK's 2025 Skynet Wrench Attacks Report described the category as an attack on the human endpoint and documented 72 verified incidents in 2025, up 75% year over year.

That distinction is important for Bitcoin holders because protocol security and personal security are separate problems. Bitcoin can be hard to seize through code, yet still vulnerable to the people presumed to control it.

A hardware wallet, seed phrase, exchange account, mobile device, or family member can become a pressure point if attackers believe it leads to transferable value.

In the Danbury case, the alleged target path ran through relatives. DOJ did not say the kidnapping victims themselves stole Bitcoin.

It said they were the parents of an individual who participated in the theft of hundreds of millions of dollars in Bitcoin. That makes the case a proxy-targeting case as well as a robbery case.

The pattern unfolding in France indicates this is a wider physical-security problem. In March, prior coverage described French crypto holders being violently targeted beyond the insider and executive class, with the target pool shifting from visible founders and relatives of crypto figures toward private individuals and homes.

Related Reading

Crypto holders in France are being violently targeted again — and it’s no longer just insiders

Once the target pool expands beyond executives, the security playbook shifts to delays, multisig, secrecy, and physical protection.

Mar 13, 2026
·
Gino Matos

Earlier reporting on a botched France home invasion tied the trend to organized target selection, executive exposure, and identity data.

Related Reading

Crypto investor hunted down in France home invasion as crypto “wrench attack” spike spreads

From the Waltio breach to suspected insider access, identity data is becoming the most valuable precursor to violence.

Feb 17, 2026
·
Gino Matos

The Danbury case brings that pattern into a U.S. court file. The visible signal was a Lamborghini. The alleged leverage point was family. The intended asset was Bitcoin.

The alleged target path ran through a person who could be pressured.

Danbury shows how a family proxy can become part of a crypto-crime record. France shows what happens when similar targeting is repeated often enough to reshape public-safety guidance, executive behavior, and holders' self-protection.

Europe is still the clearest concentration

Aside from the Danbury plea, available data points to Europe as the current center of wrench attacks.

CertiK's 2026 Wrench Attacks Overview said it recorded 34 verified incidents from January through April, with estimated losses of roughly $101 million.

Europe accounted for 28 of the 34 incidents, or 82% of the visible total, and France led the country breakdown.

CryptoSlate's May wrench-attack overview reached the same broad conclusion: the physical-extortion wave was accelerating, with the clearest concentration still in Europe, especially France.

Related Reading

IRL crypto threats: Physical “wrench attacks” have led to over $100 million in losses since January alone

Wrench attacks are forcing exchanges and holders to rethink protection as criminals target the people behind private keys.

May 11, 2026
·
Oluwapelumi Adejumo

The Danbury case shows how the same targeting model can become a matter for U.S. courts and prosecutors.

The courtroom record shows how crypto's physical-security problem can enter ordinary violent-crime enforcement. It includes recruitment, travel logistics, surveillance, family targeting, a luxury vehicle, and an alleged attempt to reach Bitcoin through human leverage.

For holders and companies, operational security now includes phishing, wallet drainers, exchange compromises, smart-contract exploits, and physical exposure around identity, home addresses, devices, and relatives.

The next legal signal is sentencing. Faiq's hearing on August 28 will show how the federal court treats his admitted role in the conspiracy.

More broadly, the cases to watch are the ones that connect crypto wealth to relatives, homes, cars, public profiles, and other offline identifiers. That is where a France-heavy security trend can become a wider law-enforcement problem, one U.S. docket at a time.

The post appeared first on CryptoSlate.