Toronto police have disclosed seven arrests and 82 criminal charges following the alleged gunpoint kidnapping of a cryptocurrency exchange owner, in a case investigators say was intended to gain access to the victim’s digital assets and business security systems.
The attack itself took place on July 25, making the October 14 announcement a major investigative update rather than a newly reported kidnapping. The arrests were carried out between July 26 and September 24 as police expanded the investigation across multiple suspects and locations.
Three of the seven accused have been confirmed as members of the Canadian Armed Forces. Searches connected to the investigation also produced an unusually large collection of weapons and ammunition, including more than 2,700 rounds, around 2,500 of which investigators determined had been stolen from the Canadian Armed Forces.
Police have not disclosed the name of the cryptocurrency exchange or the victim. Crucially, they have also not said that any cryptocurrency was successfully transferred or stolen during the abduction.
Police Say the Exchange Owner Was Targeted as He Approached His Vehicle
According to the Toronto Police Service investigation, officers responded to a reported abduction in the Finch Avenue East and Bayview Avenue area on July 25.
Investigators allege the exchange owner was targeted while approaching his vehicle, forcibly abducted at gunpoint, handcuffed and assaulted.
Police say the suspects then attempted to obtain access to cryptocurrency assets and security systems associated with the victim’s business. The victim was eventually released after allegedly being threatened and warned not to contact police.
The wording is important. Police describe an attempt to access cryptocurrency, but their public disclosure does not identify any wallet addresses, transaction values or blockchain transfers resulting from the attack. There is therefore no current basis for reporting that cryptocurrency was successfully stolen.
The first arrests came within roughly a day of the kidnapping. Raheem Bishop-Jackson, 24, and Saiefeddine Adem, 22, were arrested on July 26.
Further arrests followed on August 11, when Talarambage Fernando, 22, James Moreau, 29, and Christian Darbandi, 39, were taken into custody. Jack Miley, 24, and Suhaib Alekozai, 39, were arrested on September 24.
Police say the seven accused now face a combined 82 charges. The allegations vary by defendant and include kidnapping for ransom, forcible confinement, conspiracy, firearms offences, possession of property obtained by crime and drug-trafficking offences.
None of the allegations has been proven in court.
Searches Uncovered Guns, Silencers and Stolen Military Ammunition
The investigation widened considerably after the initial kidnapping case.
Search warrants executed at residences and vehicles across the Greater Toronto Area resulted in police seizing a shotgun, two 9mm firearms with 3D-printed receivers and a third 9mm firearm that police said was not safely stored.
Investigators also recovered two silencers, 10 over-capacity magazines and more than 2,700 rounds of ammunition, along with knives, hatchets, a crossbow, GPS tracking devices, portable radios, handcuffs, a baton, a replica firearm and a money counter.
Police also reported seizing methamphetamine, cocaine and other controlled substances.
Investigators later determined that approximately 2,500 rounds of the recovered ammunition had been stolen from the Canadian Armed Forces. Toronto police separately said five over-capacity magazines recovered during the investigation were also military property.
The military connection extends beyond the seized material. Police identified Fernando, Moreau and Miley as serving Canadian Armed Forces members and said the military cooperated with the investigation.
Police have not publicly established how the allegedly stolen military ammunition moved into the possession of the accused or whether military access played any role in planning the kidnapping. Investigators say they are continuing to examine the relationships among those charged.
The Case Shows a Different Kind of Crypto Security Threat
Most cryptocurrency security discussions begin with software: compromised private keys, malicious signatures, phishing pages, smart-contract exploits or exchange breaches.
This case is different because police allege the attackers went directly after the person capable of providing access.
That matters because cryptography is designed to prevent unauthorized parties from producing valid credentials. It cannot prevent somebody from physically coercing the legitimate credential holder into revealing information or authorizing a transaction.
Recent incidents show how varied the digital side of that threat landscape already is. A $4 million personal-wallet theft involving trader Frogman left investigators trying to determine how control of two wallets was obtained, while a separate Ledger investigation into CryptoBilis-linked wallet losses raised questions about whether security could have been compromised before users even initialized their hardware.
The Toronto case highlights a threat model that sits outside both examples. Instead of defeating the signing system electronically, an attacker can attempt to force the person controlling it to cooperate.
Crypto’s Transparency Can Create a Physical-Security Paradox
One of cryptocurrency’s defining advantages is that blockchain balances and transactions can often be independently verified.
That same transparency can become uncomfortable when public identities can be connected to valuable addresses.
An attacker does not necessarily need to know a seed phrase in advance. If they can establish that a founder, exchange operator, trader or investor controls significant assets, the person themselves can become the attack surface.
This creates a very different security problem from the one faced by ordinary financial executives.
A bank CEO generally cannot be kidnapped and forced to personally sign a blockchain transaction moving the bank’s reserves. Crypto organizations can be structurally different, particularly smaller exchanges, investment firms or trading operations where a limited number of people may retain meaningful authority over wallets, backup credentials or internal security systems.
That makes separation of authority increasingly important as asset values rise.
Multisignature wallets, withdrawal limits, delayed approvals, geographically separated signers and policies preventing any one executive from accessing large reserves can all reduce the usefulness of coercing a single individual. They cannot eliminate personal danger, but they can make kidnapping one person insufficient to move the assets.
The same principle applies to hardware security. The COLDCARD seed-generation incident demonstrated that keeping assets offline is only as strong as the process surrounding the keys. Physical coercion extends that lesson further: secure key generation does not help if operational procedures still give one person enough authority to unlock everything under duress.
The Missing Crypto Transfer May Be the Most Important Detail
There is a temptation to reduce cases like this to a headline about criminals kidnapping someone for Bitcoin or other digital assets.
But whether the attackers actually obtained control matters enormously.
If no cryptocurrency moved despite the alleged kidnapping, the victim or exchange may have had security controls that prevented immediate access even under coercion. Another possibility is simply that the alleged attackers failed before they could obtain the information they wanted.
Police have not said which explanation applies.
That is the most useful unanswered question for the crypto industry. Knowing whether the exchange used multisignature controls, delayed withdrawals, segregated access or other safeguards could reveal whether security architecture played a role in preventing the alleged attackers from converting physical control of the victim into control of the assets.
The Toronto investigation also demonstrates why measuring crypto crime solely through blockchain losses misses part of the security picture. A transaction does not need to occur for an incident to expose a serious vulnerability.
Here, police allege that an exchange owner was kidnapped at gunpoint, restrained and assaulted because attackers believed his access to digital assets and business systems had value.
For high-value crypto businesses, that shifts the security question beyond whether private keys can be hacked. The harder question is whether the organization remains secure when the person holding those keys is the target.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574