Crypto Wrench Attacks Surge 12x, Costing Victims $124M

Violent Crypto Attacks Surge, Financial Stakes Skyrocket

Violent, real-world assaults targeting cryptocurrency holders are rapidly increasing, with the financial value at stake ballooning significantly, according to a new report from blockchain security firm CertiK.

The firm documented 52 “wrench attacks”—incidents where criminals employ violence or threats to coerce victims into surrendering their crypto—in the first half of 2026. This represents a one-third increase from the 39 incidents recorded in the same period a year prior. The reported financial exposure associated with these attacks climbed nearly twelvefold, reaching $124.1 million from $10.5 million in the first half of 2025. Consequently, the average amount seized per incident surged from $270,000 to $2.39 million.

CertiK cautioned that these figures encompass ransom demands and frozen or recovered assets, not solely confirmed stolen value. The firm also highlighted that under-reporting remains a significant issue, as victims often fear retaliation or reputational damage.

Home Invasions Emerge as Dominant Threat

A “defining shift” in these attacks, the report states, is a dramatic rise in home invasions. From a single publicly reported case in the first half of 2025, such break-ins escalated to 20 in the first half of 2026, accounting for approximately 41% of all incidents. Attackers are now targeting the entire security perimeter of a victim, including their residence, family, and psychological state under duress. Kidnapping incidents remained high, increasing from 12 to 16 cases, while one murder was recorded in each of the two periods.

Western Europe Becomes Epicenter of Crisis

Geographically, the threat has increasingly concentrated in Western Europe, which accounted for 75% of verified incidents. France alone was the site of 33 attacks, representing roughly 64% of the global total. CertiK attributes France’s prominence to its substantial and visible cryptocurrency ecosystem, coupled with a series of data breaches, including the France Travail and ANTS incidents, which have provided attackers with readily available target lists.

CertiK also described a growing trend towards a professional, layered operational model. Organizers who procure data and manage logistics are positioned above disposable, often young operators recruited via messaging applications. These crews assemble “target packages” by combining information from leaked databases, exchange records, and on-chain activity, leading the firm to argue that data minimization has become a crucial measure for physical safety.

Security Advice Adapts to New Threats

The evolving threat landscape is also reshaping security recommendations. CertiK noted that hardware wallets or hidden seed phrases offer limited protection if the owner can be physically compelled to unlock them. Consequently, the firm is now advising multi-signature setups, withdrawal delays, and family “duress” protocols.

The report underscores a continuous trend of escalation, with wrench attacks showing consistent year-on-year growth. CertiK previously recorded 72 such attacks across all of 2025, a 75% increase from 2024. That year’s most alarming case involved the January kidnapping of Ledger co-founder David Balland and his wife in France. Captors severed one of Balland’s fingers to extort a multi-million-euro ransom before police successfully rescued the couple.

The targeting of relatives has become a hallmark of the French wave of attacks. In February, authorities arrested six individuals, including a minor, following the abduction of a magistrate and her mother in a crypto ransom attempt. Months later, two teenagers were charged with attempting to abduct the wife of The Sandbox co-founder Sébastien Borget outside Paris, using a fake handgun and restraints, until neighbors intervened and prompted their escape.

The scale of these criminal activities has prompted a significant response. By April, French prosecutors had charged 88 suspects—more than 10 of them minors—across 12 separate investigations. French ministers have pledged to address the issue with measures aimed at protecting cryptocurrency holders, including increased security checks at the residences of executives.