A Lincoln Park family was snatched from their townhouse on October 27, 2024, and held for five days while captors allegedly forced roughly $15 million in cryptocurrency transfers, according to court records. The victims included the household’s infant and the family’s nanny. This week, one of the men charged in the case agreed to plead guilty in federal court, a rare public development in an investigation that has stretched from Chicago to Mexico and Beijing.
How investigators say the plot unfolded
According to the Chicago Tribune, federal agents say six men wearing tactical black clothing and carrying guns knocked on the family’s Lincoln Park door, claiming they had damaged the garage. Once the door opened, the men allegedly forced three family members and a nanny into a white van. Investigators say the captors then moved the victims between an Airbnb in Forest Park and other suburban safe houses while coercing multiple cryptocurrency transfers.
The affidavit and reporting state that the victims were released on November 1, when they walked to a nearby dry cleaner and then hailed an Uber to Northwestern Memorial Hospital.
Federal case and plea
On Thursday at the Dirksen Federal Building, 34-year-old Zehuan Wei agreed to plead guilty in the federal case, his attorney told NBC Chicago. Wei’s lawyer, Alex Kessel, told the station, "My client didn't have an evil heart."
Prosecutors say Wei, described as a rideshare driver in charging documents, admitted in a plea agreement that he drove the kidnappers from California to Chicago and then to Mexico. According to the government, approximately $4 million of the transferred cryptocurrency has been recovered so far.
Money trail and missing millions
An unsealed 44-page FBI affidavit describes how the kidnappers allegedly pressured the victims to move assets on-chain and how investigators then followed the trail. According to the Chicago Tribune, agents traced travel records, rental car receipts and surveillance footage to identify suspects.
The affidavit also details physical evidence seized from rental vehicles and Airbnb properties and names six people federal authorities later charged. While some of the money has been clawed back, court filings note that millions of dollars remain missing after investigators traced the cryptocurrency flows.
Why crypto makes these attacks attractive
Security analysts say the irreversible nature of many on-chain transfers, combined with the difficulty of quickly turning crypto into easily traceable cash, can make violent extortion appealing to some organized groups. Industry research from Chainalysis and others has documented a rise in so-called "wrench attacks," in which real-world coercion is used to seize digital assets, and warns that crypto crime is becoming more professionalized and transnational.
International reach and next steps
The six suspects were charged in mid-December, and investigators say some fled the United States. Customs records and the affidavit indicate that one defendant was detained on January 17 while trying to reenter the country at the Otay Mesa crossing.
Prosecutors and defense attorneys have said several suspects flew from Mexico to Beijing and that Chinese authorities have arrested or may prosecute some individuals, according to local reporting. Court filings also state that another defendant, Ye Cao, plans to plead guilty, with a hearing set for April 23, 2026. Prosecutors say they will continue tracing on-chain flows and working with international partners.
What to watch
Federal court proceedings in Chicago, along with any cooperation that emerges from plea deals, are expected to be key to understanding who ultimately moved the funds and where they landed. For now, the case stands as a stark reminder that lucrative digital holdings can attract violent, cross-border crime. Investigators say they are continuing to work with crypto analysts and overseas authorities in an effort to recover assets and pursue additional charges.
