- CertiK recorded 52 publicly verified wrench attacks during the first half of 2026, representing a 33.3% increase compared with the same period last year.
- One of the report’s most striking findings is the geographic concentration of these attacks.
The cryptocurrency industry has spent years strengthening its defenses against cyberattacks, smart contract exploits, and phishing scams. However, a new report from blockchain security firm CertiK highlights a growing threat that cannot be mitigated by stronger code alone: physical attacks targeting crypto holders. According to the company’s latest H1 2026 Wrench Attack Report, criminals are increasingly using violence, intimidation, kidnappings, and home invasions to force victims into surrendering their digital assets.
Physical Crypto Crime Accelerates
CertiK recorded 52 publicly verified wrench attacks during the first half of 2026, representing a 33.3% increase compared with the same period last year. While the number of incidents alone is concerning, the financial impact has escalated even more dramatically. Recorded exposure linked to these attacks climbed to approximately $124.1 million, compared with just over $10.5 million in H1 2025, marking an increase of more than elevenfold. The report notes that these figures represent recorded exposure rather than confirmed stolen funds, as many incidents involve ransom demands, frozen assets, partial recoveries, or undisclosed settlements.
The first quarter accounted for much of the surge, with 35 verified incidents compared to 22 during Q1 2025. Although activity slowed during the second quarter, the overall trend suggests that physical coercion has become an increasingly attractive tactic for organized criminal groups targeting cryptocurrency investors and executives.
Europe Emerges as the Primary Hotspot
One of the report’s most striking findings is the geographic concentration of these attacks. Europe accounted for 39 of the 52 verified incidents during H1 2026, representing three-quarters of all recorded cases worldwide. Within Europe, France stood out as the epicenter, accounting for 33 incidents, or nearly two-thirds of all global cases documented by CertiK.
CertiK attributes this concentration to several overlapping factors. France has a vibrant cryptocurrency ecosystem with exchanges, investors, founders, and frequent blockchain events, making it an attractive hunting ground for criminals. At the same time, major data breaches affecting both public institutions and private organizations may have exposed personal information that can be combined with publicly available blockchain activity to identify wealthy crypto holders. Extensive media reporting and law enforcement transparency also make incidents easier to verify than in many other jurisdictions.
The report emphasizes that France’s dominance in the dataset should not necessarily be interpreted as evidence that other countries face lower risks, as reporting practices and public disclosure vary significantly across regions.
Home Invasions Become the New Strategy
Perhaps the biggest tactical shift identified by CertiK is the rapid rise of home invasions. Only one publicly reported home invasion was documented during the first half of 2025. That number jumped to 20 incidents in H1 2026, making it the single most common category of wrench attack. Kidnappings also increased from 12 to 16 cases, while torture and murder remained present, underscoring the increasingly violent nature of these crimes.
Unlike conventional cybercrime, physical attacks bypass digital security entirely. Criminals simply force victims to unlock hardware wallets, reveal seed phrases, or authorize transactions under duress. CertiK argues that traditional self-custody advice, such as keeping private keys offline, may no longer be sufficient when attackers gain direct physical access to victims and their homes. Instead, stronger custody models involving multi-signature wallets, withdrawal delays, distributed signing, and emergency response mechanisms may become increasingly necessary.
Criminal Networks Becoming More Sophisticated
The report also describes an evolution in how these attacks are planned and executed. Rather than relying solely on visible displays of wealth or social media activity, attackers increasingly build detailed target profiles using leaked databases, public blockchain information, compliance records, real estate data, phone numbers, and other personal information. Insider access to sensitive customer databases has also emerged as a growing concern, with investigations revealing instances where confidential records were allegedly sold to criminal organizations.
CertiK explains that modern wrench attacks often follow a layered organizational model. Senior organizers identify victims and coordinate laundering operations, while local teams conduct surveillance and carry out physical attacks. Ground-level participants are sometimes recruited through criminal networks or messaging platforms, allowing organizers to distance themselves from the direct execution of violent crimes.
Another disturbing trend is the increased targeting of family members, employees, assistants, and other close associates. Criminals recognize that threatening loved ones often provides stronger leverage than targeting crypto holders directly, expanding the attack surface well beyond the individual investor.
Industry Impact Extends Beyond Financial Losses
While stolen assets remain the most visible consequence, CertiK argues that the broader impact extends much further. Victims frequently face long-term psychological trauma, relocation expenses, medical costs, reputational damage, and significant disruptions to both their personal and professional lives. For founders and executives, a single physical attack may also affect treasury management, governance processes, and business continuity if critical wallet access or administrative privileges are compromised.
The report further notes that increasing regulatory reporting requirements and growing collections of customer identity data create valuable targets for attackers if those databases are breached or abused. This means security now extends beyond blockchain infrastructure and into the protection of personal information held by exchanges, governments, and service providers.
Looking ahead, CertiK expects enforcement efforts, criminal adaptation, and market visibility to shape the second half of 2026. While law enforcement operations may disrupt some criminal groups, the report warns that the financial incentives remain substantial. It recommends that individuals reduce public exposure of their crypto holdings, separate wallets by purpose, adopt multi-party custody solutions, strengthen home security, and prepare family response plans. Organizations are encouraged to eliminate single points of failure, strengthen operational security, minimize sensitive data retention, and improve monitoring of insider access to critical information.
The findings ultimately suggest that as digital assets continue gaining mainstream adoption, protecting cryptocurrency wealth will increasingly require combining cybersecurity with personal operational security. CertiK concludes that physical coercion has become an organized and evolving threat, making privacy, resilience, and comprehensive security planning essential for individuals and institutions alike.
