Key Highlights
- Over $30 million stolen through wrench attacks in H1 2026, with total exposure reaching $107 million when failed and recovered cases are included.
- France has become the global epicenter of crypto-related physical attacks, driven by a sharp rise in home invasions, kidnappings, and data breach-linked targeting.
- Chainalysis’ findings highlight growing risks to crypto self-custody, with attackers increasingly relying on physical coercion rather than technical exploits.
Wrench attacks have already extracted more than $30 million from crypto holders in successful attacks during the first half of the year, according to blockchain analytics platform Chainalysis.
In a report published on Thursday, total exposure rises to $107 million in 2026 when attempted thefts, blocked transfers, and later-recovered funds are included. If the current pace continues, 2026 would surpass the $58 million stolen during all of 2025. However, the final outcome will depend on attack activity during the remainder of the year.
H1 report points to rising physical attacks
The same day the Chainalysis findings were released, attention also turned to CertiK’s H1 2026 Wrench Attacks Report, published on July 22. CertiK documented 52 publicly verified physical attacks in the first six months of 2026, up 33% from 39 incidents in the same period of 2025, with more than $124 million in total financial exposure. That figure includes ransom demands and coerced transfers, whether or not the funds ultimately stayed with the attackers.
A wrench attack is a physical crime in which criminals use violence, threats, or coercion to force a cryptocurrency holder, or their family members, to hand over private keys or seed phrases or authorize wallet transfers. Unlike hacks or scams that exploit code or social engineering online, these attacks bypass every digital defense by targeting the human body and home. The rise of wrench attacks exposes a fundamental vulnerability in crypto’s self-custody model.
France becomes the epicenter
France has emerged as the primary hotspot for crypto-related physical attacks. Chainalysis recorded 30 publicly known incidents in the country through mid-2026, while French Interior Minister Laurent Nuñez stated authorities had logged more than 70 crypto-related violent cases. Before 2025, France registered only a handful of such crimes.
The increase has been linked to a 2024 data breach in which a tax official allegedly sold dossiers containing names, addresses, and crypto holdings of high-net-worth individuals. A subsequent breach at the crypto tax-reporting firm Waltio, affecting roughly 50,000 users, further expanded the pool of potential targets.
Attackers move to home invasions
Home invasions accounted for 37% of reported incidents in 2026, up sharply from previous years, while kidnappings remained the most common overall. Increasingly, criminals have targeted family members rather than the crypto holder directly, turning relatives into leverage.
On-chain analysis identified three tiers of attackers: opportunistic criminals who send stolen funds straight to exchanges, more sophisticated actors who use bridges and mixers, and highly embedded networks that route proceeds through laundering services tied to broader organized crime.
India crypto attacks mostly target local residents
In India, data from Chainalysis covering five known-residency wrench attack incidents shows that 80% of victims were local residents, while 20% involved non-residents such as tourists or expats. The pattern is consistent with most other countries in the report, where attackers primarily targeted domestic crypto holders rather than visitors. The Netherlands was the notable exception.
Also Read: Base Hacker Steals $500K USDC but Loses 74% in Costly Uniswap V4 Swap
