In brief
- A convicted Russian fraudster and his wife have been found dead in the UAE, after an apparent crypto wrench attack.
- The attack may have been revenge for the fraudster’s scams, with reports suggesting that the victim had defrauded international investors of as much as $500 million.
- Experts report that so-called wrench attacks are rising, although they suggest that the average retail investor has less to fear than influencers who flaunt their wealth.
A convicted Russian crypto scammer and his wife have been found dead in the United Arab Emirates after the pair met with a group of men posing as investors, according to reports in Russian media.
Roman Novak, from Leningrad, had been sentenced to six years in prison in Moscow in 2020, following an investment scam in which he defrauded victims of millions in cryptocurrencies.
He was released from prison in 2023 and returned to crypto, promoting a payment platform called Fintopia, which he reportedly used to defraud investors from China, the Middle East and elsewhere of as much as $500 million.
He then fled to Dubai, where in October of this year he and his wife Anna met with a man posing as an investor, travelling by car to a villa on the outskirts of the city.
At the villa, Novak was confronted by a group of men who demanded access to his cryptocurrency wallets, according to Russian news outlet Fontanka.
Fontanka reports that the assailants gained access to Novak’s wallets only to find them empty, after which they murdered Novak and his wife. Their bodies were reportedly dismembered and dumped in bags in the desert surrounding the city of Fujairah, with the murderers attempting to cover their tracks by swapping vehicles as they left the UAE for Russia and, in one case, Georgia.
UAE-based police were able to track the group’s movements, identifying eight suspects, all of whom are Russian nationals.
Five ‘mules’—who rented the villa used in the attack and carried out other preparatory work—are reportedly not facing charges for the murders.
The other three include a former homicide officer who had been convicted on drugs charges, while two are discharged veterans of the current Russia-Ukraine conflict.
Crypto ‘wrench attacks’
Their attack on the Novaks took place within a context of rising physical cryptocurrency attacks, also known as ‘wrench’ attacks.
According to David Richards, the CEO of analytics and forensics firm BlockchainUnmasked’s CEO, such attacks are on the rise.
“We’re seeing a clear surge in ‘wrench attacks,’ where criminals torture or threaten victims to drain wallets,” he told Decrypt, noting that Jameson Lopp’s tracker has recorded 48 attacks in 2025 so far.
This contrasts with 32 recorded for all of 2024, with Richards explaining that the increase largely stems from cryptocurrency price rises, in addition to the fact that criminals are making increasingly sophisticated use of social media and other tech.
“France alone had 10 cases in the first half of 2025,” he said. “The U.S. is up by 169%.”
As with the case of Roman and Anna Novak, some of these attacks have had gruesome details, including finger amputations and murders.
It’s also possible that cases and attacks have been underreported—something which tends to happen with crypto-related crime, according to Richards.
Yet Richards also adds that it’s not a merely crypto-specific problem, but rather “a violent crime wave” that happens to take cryptocurrencies as its target.
“We expect it to get worse through 2026 unless privacy tools and global law enforcement coordination scale fast,” he added.
This may sound alarming, but Richards explains that the average retail investor, who solely uses regulated exchanges for trading, has much less to fear than someone like Novak, who was “a walking red flag.”
“This wasn’t a random attack,” he said. “He scammed $500m, had a prior conviction for fraud, and was flaunting it in Dubai.”
For Richards, the attack was likely revenge, as has been reported in local media, given that fraudsters such as Novak tend to have enemies with motives and resources, and also tend to leave digital trails that make targeting significantly easier.
However, he also advises retail advisers to stay as “boring” as possible, meaning that they shouldn’t post about their crypto profits and successes, and while also using multi-factor authentication (and not just two-factor authentication).
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
