Handling Kidnap and Rescue (K&R) Ransom Payments in Cryptocurrency
Picture: Fortis Advisory - Supplied
Article Excerpt:
While the majority of kidnap for ransom cases still involve cash, we are witnessing a growing number of incidents where the ransom is demanded in cryptocurrency. This trend is especially apparent when the victim holds crypto, but increasingly organised crime groups are issuing demands in Bitcoin, Monero, or stablecoins. In South Africa, for example, three out of four kidnap ransom demands now involve cryptocurrency.
Dealing with a ransom demand in cryptocurrency brings a distinct set of operational and legal challenges. Few response consultants have yet faced this payment method in live cases, but it is becoming harder to ignore. Valuable insights can be drawn from ransomware incidents, where cryptocurrency has long been the standard means of payment.
In this article, we outline what consultants must know when advising on crypto payments, focusing on two central questions. What are best practices for making a ransom payment in cryptocurrency? And what can go wrong that needs to be avoided?
Topics discussed in this article include:
Currency and Wallet Readiness
Handling Crypto Volatility
Payments and Compliance
Operational Security, Tracing and Evidence
Lessons from Ransomware Applied to K&R
Evan Vougdis, our Head of Cyber Threat Intelligence and Response provided expert insight in this article.
Source: Fortis Advisory - Wednesday 17 September 2025
Author: By Ruben Hoornveld
Reference: Handling K&R Ransom Payments in Cryptocurrency
To explore NSB Cyber’s Threat Intelligence services, including ransomware response and negotiation, head here.