Physical attacks targeting cryptocurrency holders have already reached more than $30 million in losses through the first half of 2026, putting the year on pace for the worst total on record, according to new research from blockchain analytics firm Chainalysis.
The report, published Thursday, documented 46 violent crypto attacks through late June. The firm said the surge reflects a calculated criminal strategy targeting people who hold wealth in a form that can be transferred instantly and irreversibly.
Home Invasions Rise as Preferred Tactic
While kidnappings remain the most frequently documented attack type, home invasions have grown significantly as a share of incidents, climbing to 37% of documented cases from 26% in 2023. Chainalysis said the shift is logical from an attacker’s perspective.
‘Home invasions allow criminals to confront victims in a controlled environment where they can compel a transfer of funds,’ the firm wrote. ‘Kidnappings, by contrast, are much more difficult to execute. Attackers must expend considerable time and resources planning logistics; and the extended periods spent with victims leaves the attacker exposed for longer.’
The report also found attackers are increasingly targeting relatives and acquaintances rather than the holders themselves, adding pressure by threatening close associates to force crypto transfers.
France Leads the World in Documented Incidents
France has emerged as the country with the highest number of recorded wrench attacks, logging 30 incidents through mid-2026, more than any other nation. Chainalysis said the increase appears to be linked to an alleged breach involving tax records that exposed information about high-net-worth crypto holders.
The French findings align with a broader law enforcement crackdown that has been building over the past year. In April 2026, French authorities charged 88 suspects, including more than 10 minors, across 12 separate investigations targeting organised gangs accused of carrying out a series of violent crypto crimes. In June 2026, authorities indicted a man accused of participating in an attack after allegedly posing as a police officer.
Laundering Methods Range From Basic to Sophisticated
Chainalysis identified a spectrum of sophistication in how stolen funds are moved. Some attackers show minimal knowledge of crypto infrastructure, routing stolen funds directly to centralised exchanges with no attempt to obscure the trail.
‘Mid-tier attackers demonstrate greater familiarity with crypto infrastructure,’ Chainalysis wrote. ‘They may use decentralised exchanges, bridges, MEV bots, and other DeFi tools to swap and move assets across chains. They understand that centralised exchanges represent chokepoints with sophisticated compliance programs and user KYC, and attempt to avoid or delay interaction with them.’
Escalating Global Pattern
The Chainalysis data arrives against a backdrop of rapidly worsening global trends. CertiK reported in February 2026 that wrench attacks climbed 75% in 2025 to a record 72 incidents. By July 2026, CertiK estimated financial exposure from wrench attacks had reached $124 million in the first half of 2026. The two figures measure different things, one counting losses to victims and the other total exposure, and both capture only incidents that became publicly known, so each should be read as a floor rather than a full count.
This week, five men were convicted in London of imprisoning and torturing two French crypto millionaires in an extortion scheme. In the United States, ransom notes demanding Bitcoin surfaced earlier this year during the investigation into the kidnapping of Nancy Guthrie, mother of ‘Today’ show host Savannah Guthrie.
