Crypto-kidnappings: police close Reacher, a stolen data engine run by 3 teenagers

A name, telephone number or IBAN. It didn't take much on Reacher to bring up a stranger's profile. On October 6, the police closed this search engine for stolen data and arrested its three administrators. They are 17 years old.

For holders of cryptocurrencies, the affair touches a raw nerve. For months, investigators and associations have been pointing to data leaks as the fuel for crypto kidnappings, much more than bitcoin itself.

Reacher: a search engine with 730 million lines

The National Police detailed the operation this Wednesday, October 14. Created in March 2026, the platform claimed 730 million rows of indexed data and more than 3 million searches. Renamed Stryx at the beginning of the summer, the Anti-Cybercrime Office (OFAC) took it offline. The police are talking about a first in France for this type of site.

The principle has a name in the industry: a “lookup”. You type a name, number, license plate or IBAN. Then, the site crosses hundreds of leaks and tells you everything it knows about the targeted person. As for access, it was free or by subscription, with credits to be purchased to increase the number of requests.

It all started with a report from the e-Enfance association on May 15. The three minors are being prosecuted in particular for concealment of fraudulent extraction of data by an organized gang. They face up to ten years in prison, with a trial scheduled for January 2027.

Lookups and crypto kidnappings: the same chain

Nothing at this stage links Reacher to a specific crypto attack. On the other hand, the modus operandi of the kidnappers sticks exactly to what these sites were selling.

The Ministry of the Interior recorded 90 acts of violence linked to cryptocurrencies between January 1 and mid-August 2026: kidnappings, sequestration, extortion. Above all, investigators favor a lead, the identification of victims based on their personal data. The ministry transmitted these figures to Cointelegraph, without publishing them in detail.

The reasoning is simple. Leak from crypto service reveals who owns digital assets. That of Waltio, in January 2026, exposed around 50,000 users. A lookup like Reacher then provides the address, telephone number, and sometimes the vehicle. From then on, all that remains is to ring the bell.

Reacher fallen, the other lookups are still running

Be careful before declaring victory. According to Police & Réalités, another service called BrixHub claims 11 billion pieces of data. Reported to the courts on October 5, he nevertheless remains online to this day.

The captured files also contain Reacher customer data. Investigators are analyzing them. Consequently, some users could in turn end up in court. For a band of kidnappers who would have paid for research credits, the trace now exists somewhere.