Three Canadian soldiers among seven charged after armed crypto abduction in Toronto

Toronto police have charged seven men, three of them Canadian Army reservists, with a combined 82 offences in a crypto kidnapping case: the owner of a cryptocurrency business was abducted at gunpoint in North York on 25 July 2026. Police set out the case at a press conference on 14 October, CP24 reported. They allege the men who took him tried to get into his crypto holdings and his company’s security systems before letting him go. None of the allegations has been tested in court, and all seven men are presumed innocent.

The investigation did not stay a kidnapping case for long. Searches of homes and vehicles across the Greater Toronto Area turned up about 2,500 rounds of ammunition that police say came from the Canadian Armed Forces, along with two handguns with 3D-printed receivers, silencers and drugs.

The three soldiers serve in the army reserve. Two of them, Fernando and Moreau, are bombardiers in the 7th Toronto Regiment, a reserve artillery unit based at Moss Park Armoury on Queen Street East. The third, Jack Miley, is a master bombardier.

Crypto kidnapping in Toronto: what police say happened on 25 July

The victim was approached as he reached his vehicle near Finch Avenue East and Bayview Avenue, according to CP24 and Global News. Police say he was taken at gunpoint, handcuffed and assaulted.

His captors wanted two things, police allege: access to his cryptocurrency and access to the security systems of his business. The Canadian Press describes him as the owner of a cryptocurrency exchange. Police have not named him or the company.

He was let go with a warning not to contact the police. He had minor injuries, according to The Canadian Press, and the case reached investigators anyway.

Investigators moved quickly. Within 24 hours they had identified a suspect vehicle and arrested two men. Whether any crypto was actually transferred during the abduction, and how much, has not been disclosed.

Seven accused, three arrest waves, 82 charges

The arrests came in three rounds over two months. The table below is built from Global News, CP24 and The Canadian Press reports of 14 October, with arrest dates as reported by Global News and CryptoSlate.

Outlets spell one name differently. CP24 uses “Talarambage Fernando”, Global News “Sachintha Fernando”, and The Canadian Press the full form used above.

What the charges cover

Across the seven men, police have laid 82 charges. They include kidnapping for ransom, forcible confinement, unauthorized possession of a firearm and possession of drugs for the purpose of trafficking. All but one of the accused face a kidnapping for ransom count, The Canadian Press reported.

Fernando faces 20 charges, most of them firearms offences, according to The Canadian Press. Moreau is charged with two counts of possession for the purpose of trafficking, the only drug charges among the three soldiers. Miley is accused of kidnapping for ransom with a firearm, unauthorized possession of a firearm in a motor vehicle and conspiracy, Global News reported.

Per-person totals beyond that are not consistent across the coverage, so we use the 82 overall figure. No plea has been reported, and no trial date has been published.

Military ammunition and 3D-printed guns in the searches

Search warrants executed at homes and vehicles produced a second case on top of the first. Police say about 2,500 rounds of ammunition and five over-capacity magazines belonged to the Canadian Armed Forces. Roughly half of those rounds were blanks, The Canadian Press reported.

The military had not reported the ammunition missing. It confirmed only after the seizures that the rounds were military stock, according to CP24 and Global News.

Across all the searches, CryptoSlate lists the following items, citing the police release, with additions from Global News and CP24.

Police have not said that the military ammunition or any of the seized guns were used in the July abduction. That link, if there is one, has not been made public.

Staff Superintendent Joe Matthews pointed at the people being targeted. “Criminals continue to adapt their methods and seek new opportunities for financial gain,” he said in the police release, as quoted by CP24. He described the “increasingly sophisticated and targeted nature of crimes involving digital assets,” and called the soldiers “highly trained individuals with access to firearms.”

Police Chief Myron Demkiw spoke about the military training of three of the accused. When people with that background are alleged to have been “taking somebody off the street by force, that is incredibly concerning,” he said, as quoted by CP24. He also said investigators are “often hampered by encryption” when trying to follow criminal activity; officers are still going through seized phones and computers.

What the Department of National Defence says

All three soldiers have been removed from military duties. Their access to Canadian Armed Forces equipment, facilities and bases has been restricted, the Department of National Defence told Global News. “They remain members of the CAF pending the outcome of an administrative review,” the department said, as quoted by Global News on 5 October.

“Military police are investigating the matter and cooperating with the Toronto Police Service as needed,” DND said, according to CP24. The department also says it is tightening ammunition oversight, with inventory validation and stock counts, and plans to modernize how it manages ammunition this fall.

The military side of the story first surfaced on 5 October, when Global News reported that two soldiers, Fernando and Moreau, faced charges. Miley, the third reservist, had been arrested on 24 September; his name came out with the police update of 14 October.

What police have not said

Toronto police say the investigation remains active, but they are not looking for more suspects. They are still examining how the seven men are connected to each other, and they have not linked the group to a larger organized crime network, according to CP24, Global News and The Canadian Press.

Several questions remain open:

• who the victim is and which exchange or business he runs;
• whether any crypto changed hands, and how much;
• what role each accused is alleged to have played;
• how the military ammunition left Canadian Armed Forces stocks;
• how the attackers picked their target, and whether leaked customer data or inside knowledge played a part.

Not the first crypto abduction in Toronto

In November 2024, WonderFi chief executive Dean Skurka was abducted near University Avenue and Richmond Street in downtown Toronto. He was released after a ransom of about $1 million was paid electronically, according to a source close to the investigation cited by CBC News; police did not confirm that figure. He was found uninjured in Centennial Park in Etobicoke. WonderFi said client funds and data were not affected.

Two years earlier, in December 2022, Aiden Pleterski, the Ontario investor known as the “Crypto King”, was held for three days and beaten by captors seeking money. In October 2025 one of the accused, Deren Akyeam-Pong, pleaded guilty in Ontario Superior Court in Toronto to nine charges including kidnapping, CBC News reported. The charges against his co-accused have not been tested in court.

Jameson Lopp, co-founder of the custody firm Casa, keeps a public list of physical attacks on crypto holders dating back to 2014. For Canada it also lists a couple kidnapped in Montreal in March 2024 and robbed of $25,000 in crypto, a home invasion in Verdun, Quebec, in August 2024, and a victim forced into a van and threatened with a gun in Cambridge, Ontario, in September 2025. Lopp notes the list is not complete, because many attacks go unreported.

Wrench attacks on crypto holders: 52 cases in six months

Security researchers call this kind of crime a wrench attack. The name comes from a 2009 xkcd comic: rather than crack strong encryption, an attacker threatens the person who holds the keys. Crypto makes such attacks attractive because a transfer, once signed, is fast and cannot be reversed by a bank.

CertiK’s report for the first half of 2026, published on 23 July, counted 52 verified wrench attacks worldwide, against 39 in the first half of 2025. Recorded exposure, a measure that includes ransoms demanded, transfers and frozen funds as well as confirmed losses, came to about $124.2 million, against about $10.5 million a year earlier.

The United States had four incidents in the period, the United Kingdom and Sweden two each. CertiK wrote that the threat “has narrowed into a Western European crisis”. Home invasions made up about 41% of its first-half cases, and the firm flagged attackers threatening spouses, parents, children or employees to put pressure on the holder.

France has become the centre of the problem

French figures are larger still. The Interior Ministry counted 90 cases of crypto-related violence between 1 January and mid-August 2026, with 223 arrests and 126 people jailed between January and July, according to data given to Cointelegraph and reported by CryptoActu. More than 40% of victims were relatives or acquaintances of crypto holders. The ministry calls it the first national count built on this definition, so it cannot be set against 2025.

Prosecutors have their own tally. In April 2026 France’s new national organised crime prosecutor’s office (PNACO) counted 135 crypto-related kidnappings or attempts since 2023, with 88 suspects charged and 75 held in pre-trial detention, more than 10 of them minors, Cryptoast reported.

The best-known French case came in January 2025, when Ledger co-founder David Balland and his partner were taken from their home in Méreau, near Vierzon. Fellow co-founder Éric Larchevêque received a video showing a mutilated finger and a crypto ransom demand. Balland was freed the next day by an operation of about 230 officers, including the GIGN, and seven people were held in pre-trial detention on charges including gang kidnapping and torture, The Local reported.

Data leaks keep coming up in the French investigations. On 5 January 2026 Ledger told customers that names and contact details tied to Ledger.com orders had been accessed in the systems of Global-e, the e-commerce firm that handles those sales, The Block reported; Ledger said wallets and payment data were not affected. Cryptoast cites a leak at Waltio, a French crypto tax-reporting service, as a possible way the victims of a June 2026 abduction in Vaujours were identified.

How crypto holders can lower the risk of a wrench attack

No setup makes a person safe from someone holding a gun. The aim is to make you a poor target and to make sure funds cannot all be moved in a few minutes under threat. CertiK’s July report lists measures along these lines:

• Stay quiet about your holdings. Old posts, conference badges and screenshots of balances tell attackers who to watch. Remove what you can and stop adding more.
• Keep a small spending wallet separate. Hold day-to-day amounts in one wallet and the rest elsewhere, so that what you can open on your phone is not everything you own.
• Store the seed phrase away from the device. A hardware wallet and its recovery words kept in the same drawer at home defeat the point. Our guide to backing up and storing a seed phrase covers safer options, and setting up a hardware wallet walks through the device side.
• Slow down large transfers. Multisig wallets with co-signers in other places, time locks, withdrawal delays and daily limits mean that nobody, including you, can empty the main holdings on the spot.
• Agree a plan with your family. With relatives now a large share of victims in France, they need to know what to do, and what not to share, if someone comes to the door.
• Limit the data you leave behind. Platforms and shops that hold your name, address and ID can leak them. Use those that keep as little as possible, and treat any breach notice about your crypto purchases seriously.

Holding coins yourself and holding them on a platform carry different risks. Our explainer on self-custody and our guide to types of crypto wallets set out the trade-offs. Business owners, like the Toronto victim, have a second layer to protect: staff, office systems and company wallets.

What happens next in the Toronto case

The seven men will go through the Ontario court system; no court dates have been published. Bail decisions and any trial date are the next public milestones. The Canadian Armed Forces administrative review of the three reservists and the military police investigation continue alongside the criminal case, and DND has said its ammunition-management changes will come this fall.

CertiK published its first-half figures on 23 July; if it keeps the same rhythm, numbers for the second half of 2026 would land around January 2027. The Toronto abduction falls in that period.