The two biblical passages that anchor this question point in different directions. Shemot 21:16 states that one who kidnaps a person — whether having sold him or still holding him — shall be put to death, appearing to impose liability on the act of abduction alone. Devarim 24:7, however, adds the elements of exploitation and sale: "If a man shall be found abducting a person of his brethren… and he exploited him and sold him, then that abductor shall die," a formulation that implies liability requires more than mere abduction.
The Mishnah in Sanhedrin 85b directly structures this dispute around the verses. The anonymous first opinion holds that the kidnapper is not liable unless he brings the victim into his own domain — but says nothing of sale as an additional requirement. Rabbi Yehuda goes further, reading "and he exploited him and sold him" in Devarim 24:7 to require both bringing the victim into one's domain and making use of him before liability attaches — though even Rabbi Yehuda does not isolate sale alone as the trigger.
The Gemara in Sanhedrin 86a derives the prohibition against kidnapping itself from two separate verses — Rabbi Yoshiya from "You shall not steal" (Shemot 20:13) addressing the act of taking, and Rabbi Yochanan from "Do not sell him in the manner of a slave" (Vayikra 25:42) addressing the sale — and the Gemara reconciles them as speaking to two distinct negative commandments, one against the abduction and one against the sale, a framework that bears directly on what each stage of liability requires.
The Ramban (Shemot 21:16) draws on the Mishnah and baraita to spell out that Shemot 21:16 comes to teach that one who abducted but did not sell, or who sold but while the victim remained in the kidnapper's own domain, is exempt; full liability requires that the kidnapper both bring the victim into his domain and effectuate a sale, so that the victim is "found in his hand" — yet if the kidnapper physically lifted the victim onto his shoulder and sold him, that physical control constitutes the required domain.
Mishneh Torah, Laws of Theft ch. 9 codifies the outcome: a kidnapper is not liable for capital punishment until he kidnaps a Jew, brings him into his own domain, and then sells him — both the act of abduction into one's domain and the act of sale are necessary conditions for the capital penalty, though each act separately violates a distinct negative commandment.
Sefer HaChinukh (36:3) confirms this reading explicitly, stating that the violator is liable to strangulation only if he has already sold that soul — "since the explanation has come (Sanhedrin 85b) that the liability does not rest upon him until he sells" — and grounding that ruling in the verse in Shemot that names sale as part of the liability formula.