================================================================================================
CASE 232  |  Festo Ivaibi  |  May 17, 2025  |  Uganda
================================================================================================

DATABASE RECORD
  id                  232
  date                May 17, 2025
  original_date       nan
  year                2025
  month               5
  quarter             2025-Q2
  victim              Festo Ivaibi
  location            Kampala
  country             Uganda
  scenario            Authority Misuse
  description         Crypto founder abducted by men posing as military, forced to transfer $500,000 at gunpoint. Company claims at least 48! such cases in Uganda stay officially unreported.
  kidnappings         1
  violence_torture    0
  drugs_alcohol       0
  weapons             1
  theft               1
  life_taken          0
  money_wanted        $500,000 
  coin_type           Crypto
  reports             Decrypt
  notes               The assailants impersonated military officers
  has_processed_date  1
  created_at          2025-11-13 05:44:45
  (flag legend: 'kidnappings' is the DETENTION flag — 1 when the victim was held against
   their will at any point, tied, locked in, held at gunpoint or taken away; it is NOT the
   same as the 'Kidnapping' scenario, which means taken away and held. See README, Definitions.)

AI SUMMARY  [revised on review, verified against the sources in this file. Live DB still holds the shorter bulk-import summary — apply this to it.]
  **Victims:** Festo Ivaibi, founder of the cryptocurrency education hub Mitroplus Labs, abducted near his home on Bunamwaya Road in Kampala, Uganda.
  
  **Attackers:** Armed men in military uniforms who claimed to be UPDF "security operatives"; according to a statement from Mitroplus's Afro Token Project, the plot allegedly involved informants posing as crypto traders, rogue officers and two Chinese nationals.
  
  **Attack Method:** On 17 May 2025 the armed, uniformed group seized Ivaibi near his residence.
  
  **Violence Used:** Detention — he was held at gunpoint and forced to unlock his cryptocurrency wallets.
  
  **Crypto Demanded/Stolen:** He was made to transfer about $500,000 in cryptocurrency to a wallet the attackers controlled, and a portion of Afro Token (a meme coin) was sold under coercion.
  
  **Status:** Mitroplus Labs claims at least 48 similar attacks have taken place in Uganda, most of them unreported; Decrypt said it had approached Mitroplus and the UPDF for comment.

LINKED SOURCES
  [url]  https://decrypt.co/321273/crypto-founder-abducted-500k-gunpoint

NOTES ON THIS FILE
  * matched to sheet row 233: exact match on victim + year, unique on both sides

------------------------------------------------------------------------------------------------
ARTICLE 1
  Source   Decrypt
  URL      https://decrypt.co/321273/crypto-founder-abducted-500k-gunpoint
  Origin   reported_K&R sheet, row 233, column "Articles"
  Length   3,709 chars
  Trimmed  site furniture removed on review; kept text is verbatim. Full original (5,153 chars) archived, sha256 81a23111ca0065b68372f06e3b1cd6a45750cf3d4aa4181cc4c7287a858bcfb1
------------------------------------------------------------------------------------------------
Crypto Founder Abducted in Uganda, Forced to Send $500,000 at Gunpoint
Mitroplus Labs said its founder was forced to send crypto from multiple wallets by men impersonating military officers.
A crypto founder was abducted in Uganda, held at gunpoint, and forced to send crypto worth $500,000 to his attackers, in the latest of a spate of crypto kidnap attempts.
Festo Ivaibi, founder of crypto education hub Mitroplus Labs, was abducted on May 17 near his residence on Bunamwaya Road in Kampala, Uganda.
The attackers were reportedly armed, dressed in military uniforms, and claimed to be "security operatives" of the Uganda People's Defence Forces, or UPDF, according to a formal statement from Mitroplus's Afro Token Project account on X.
The armed group allegedly forced Ivaibi to unlock crypto wallets and transfer $500,000 in crypto to their controlled wallet. A portion of Afro Token, a meme coin, was also sold under coercion, Mitroplus Labs claimed.
CRYPTO ABDUCTION IN UGANDA. 
On Saturday, May 17th 2025, our founder @IvaibiFesto was abducted by individuals posing as security agents(@MODVA_UPDF) and forced under duress, to release his crypto assets. We thank God he is now safe, and all systems have been secured.
"This is not just an attack on one person, it's an attack on a growing vision," the project said.
Afro Token was created on SunPump, a meme coin platform on the Tron blockchain. The cryptocurrency used for the other coerced transfers is unclear, though some amounts were reportedly sent to a Binance wallet.
Data from DEX Screener shows the token's value has dropped by roughly 16.7% since the day of the attack, with a remaining market cap of around $1.6 million, down from over $7.3 million in December last year.
Decrypt has reached out to Mitroplus Labs and the UPDF for comment and will update this article should they respond.
'Wrench attacks' on the rise
Mitroplus Labs alleges that the attack is part of a coordinated pattern involving informants posing as crypto traders, rogue law enforcement officers, and two Chinese nationals.
The firm claimed that at least 48 similar attacks have been identified, with many cases being dismissed "at the influence of their ring."
Wrench attacks, thefts in which crypto holders are physically threatened, have proliferated in recent months.
Earlier this year, David Balland, co-founder of hardware wallet manufacturer Ledger, was kidnapped and mutilated as part of a ransom demand. In February, a crypto broker broke his ankles attempting to flee captors.
Just this month, the father of a crypto entrepreneur was freed in a police raid after kidnappers demanded almost $8 million for ransom in crypto.
The challenge with wrench attacks lies in how they are executed physically "to reveal private keys or authorize transactions under duress," Michael Pearl, vice president of strategy at blockchain security firm CyVers, told Decrypt.
Pearl suggests security methods such as multi-factor authentication could help make "forced transfers harder to execute without alerting others." Monitoring "unusual transaction patterns or access from new devices" could also help by "triggering alerts or temporary freezes to protect assets," he added.
Still, wrench attacks continue amid “widening income disparity and the skyrocketing value of crypto,” Harry Halpin, CEO of decentralized VPN service Nym, told Decrypt in an emailed statement.
And yet, governments are “demanding more transparency and identity data," which could easily get leaked to criminals trying to target crypto holders, Halpin noted.
Using VPNs (virtual private networks) is one of a number of techniques that crypto users could practice to maintain security, Halpin suggested.

------------------------------------------------------------------------------------------------
FETCHED ARTICLE 1  [AUTO-TRIMMED — UNREVIEWED]
  !! Furniture was cut by a script keyed on this case's record, not by a person.
  !! It may still carry passages about OTHER cases from a round-up article.
  !! The full page extract is kept in staging/ if a cut needs revisiting.
  Source     decrypt.co
  URL        https://decrypt.co/321273/crypto-founder-abducted-500k-gunpoint
  Field      url
  Retrieved  2026-09-05T12:47:18+00:00 via raw HTTP retrieval, deterministic extraction (HTTP 200)
  Language   unknown
  Kept       paragraphs headline [0] + 1-26 of 27
  Length     4,117 chars
  Integrity  sha256 ba577dc8708da186ed507b9ced155c6df54406940b22ddb707c58aeff5159a7d
  Trimmed    AUTO-TRIMMED, unreviewed: kept paragraphs 1-26 plus headline [0]; dropped 0 leading and 0 trailing paragraphs. Case-term hits on page: 28.
  Caveat     retrieved from a live page on the date above. Unlike text copied
             from the spreadsheet, there is no second copy to hash it against.
------------------------------------------------------------------------------------------------

ORIGINAL (unknown, verbatim as retrieved)

Crypto Founder Abducted in Uganda, Forced to Send $500,000 at Gunpoint - Decrypt

Mitroplus Labs founder Festo Ivaibi was abducted near his home on May 17 and forced to transfer crypto worth roughly half a million dollars.

The firm claims over 48 similar crypto-related attacks have occurred in Uganda, though most remain unreported.

Experts urge better coordination between physical safety protocols and digital asset protections.

A crypto founder was abducted in Uganda, held at gunpoint, and forced to send crypto worth $500,000 to his attackers, in the latest of a spate of crypto kidnap attempts.

Festo Ivaibi, founder of crypto education hub Mitroplus Labs, was abducted on May 17 near his residence on Bunamwaya Road in Kampala, Uganda.

The attackers were reportedly armed, dressed in military uniforms, and claimed to be "security operatives" of the Uganda People's Defence Forces, or UPDF, according to a formal statement from Mitroplus's Afro Token Project account on X.

The armed group allegedly forced Ivaibi to unlock crypto wallets and transfer $500,000 in crypto to their controlled wallet. A portion of Afro Token, a meme coin, was also sold under coercion, Mitroplus Labs claimed.

CRYPTO ABDUCTION IN UGANDA.

On Saturday, May 17th 2025, our founder @IvaibiFesto was abducted by individuals posing as security agents(@MODVA_UPDF) and forced under duress, to release his crypto assets. We thank God he is now safe, and all systems have been secured.

— Afro Token (@AfroTokenSUN) May 19, 2025

"This is not just an attack on one person, it's an attack on a growing vision," the project said.

Afro Token was created on SunPump, a meme coin platform on the Tron blockchain. The cryptocurrency used for the other coerced transfers is unclear, though some amounts were reportedly sent to a Binance wallet.

Data from DEX Screener shows the token's value has dropped by roughly 16.7% since the day of the attack, with a remaining market cap of around $1.6 million, down from over $7.3 million in December last year.

Decrypt has reached out to Mitroplus Labs and the UPDF for comment and will update this article should they respond.

Mitroplus Labs alleges that the attack is part of a coordinated pattern involving informants posing as crypto traders, rogue law enforcement officers, and two Chinese nationals.

The firm claimed that at least 48 similar attacks have been identified, with many cases being dismissed "at the influence of their ring."

Wrench attacks, thefts in which crypto holders are physically threatened, have proliferated in recent months.

Earlier this year, David Balland, co-founder of hardware wallet manufacturer Ledger, was kidnapped and mutilated as part of a ransom demand. In February, a crypto broker broke his ankles attempting to flee captors.

Just this month, the father of a crypto entrepreneur was freed in a police raid after kidnappers demanded almost $8 million for ransom in crypto.

The challenge with wrench attacks lies in how they are executed physically "to reveal private keys or authorize transactions under duress," Michael Pearl, vice president of strategy at blockchain security firm CyVers, told Decrypt.

Pearl suggests security methods such as multi-factor authentication could help make "forced transfers harder to execute without alerting others." Monitoring "unusual transaction patterns or access from new devices" could also help by "triggering alerts or temporary freezes to protect assets," he added.

Still, wrench attacks continue amid “widening income disparity and the skyrocketing value of crypto,” Harry Halpin, CEO of decentralized VPN service Nym, told Decrypt in an emailed statement.

And yet, governments are “demanding more transparency and identity data," which could easily get leaked to criminals trying to target crypto holders, Halpin noted.

Using VPNs (virtual private networks) is one of a number of techniques that crypto users could practice to maintain security, Halpin suggested.

Edited by Stacy Elliott.

Start every day with the top news stories right now, plus original features, a podcast, videos and more.

================================================================================================
generated from attacks-export-Gart-website.json + reported_K&R  |  case 232
================================================================================================
