Physical attacks targeting cryptocurrency holders surged dramatically in the first half of 2026, with recorded financial exposure jumping nearly 12 times year-on-year, according to a new report from blockchain security firm CertiK.
The firm verified 52 so-called ‘wrench attacks’ globally between January and June 2026, up by a third from 39 incidents in the same period of 2025. Recorded financial exposure climbed to $124.1 million from $10.5 million in H1 2025, lifting the average haul per incident from $270,000 to $2.39 million.
Home Invasions Become the Dominant Vector
CertiK identified a surge in home invasions as the defining shift of the period. From a single publicly reported case in H1 2025, residential break-ins rose to 20 incidents in the first half of 2026, representing roughly 41% of all verified attacks. Kidnapping cases also increased, climbing from 12 to 16. One murder was recorded in each comparable period.
The firm noted that attackers are now targeting the full security perimeter of their victims, including residences, family members, and the victim’s ability to remain calm under physical duress. CertiK cautioned that all figures capture ransom demands alongside frozen or recovered assets, and that under-reporting remains severe because victims fear retaliation and reputational damage.
France Accounts for 64% of Global Cases
Geographically, the crisis has concentrated sharply in Western Europe. The region accounted for 75% of verified incidents, with France alone responsible for 33 of the 52 global cases, approximately 64% of the total. CertiK links France’s prominence to its large and visible crypto community combined with a series of major data breaches, including the France Travail and ANTS incidents, which provided criminal networks with ready-made target lists of crypto holders.
The firm described an increasingly professional, layered criminal model. Organizers purchase leaked data and coordinate logistics, while disposable young operators recruited via messaging apps carry out attacks on the ground. Criminal crews now build ‘target packages’ drawing on leaked databases, exchange records, and on-chain activity. CertiK argues that data minimization has therefore become a physical safety measure, not just a privacy one.
Security Advice Is Changing
The threat profile is forcing a rethink of personal security strategies. CertiK noted that hardware wallets and hidden seed phrases offer limited protection if an attacker can physically compel the owner to unlock them. The firm now recommends multi-signature wallet setups, withdrawal time delays, and family ‘duress’ protocols designed to trigger alerts or lock funds when a holder is under coercion.
The report continues a stark year-on-year escalation. CertiK previously recorded 72 wrench attacks across all of 2025, itself a 75% jump on 2024. The most high-profile 2025 case was the January kidnapping of Ledger co-founder David Balland and his wife in France, during which captors severed one of Balland’s fingers before police freed them.
In France, the targeting of family members has become a hallmark of recent attacks. In February 2026, authorities arrested six suspects, including a minor, after a magistrate and her mother were abducted in a crypto ransom attempt. Months later, two teenagers were charged with attempting to abduct the wife of The Sandbox co-founder Sébastien Borget outside Paris using a fake handgun and restraints, before neighbors intervened.
By April, French prosecutors had charged 88 suspects across 12 investigations, more than 10 of them minors, with French ministers vowing protective measures including welfare checks at executives’ homes.
