Crypto ‘Wrench Attacks’ Cost Victims $124M in Six Months, Up 12x: CertiK

Violent, real-world attacks on crypto holders are escalating fast, and the money at stake has ballooned, according to a new report from blockchain security firm CertiK.

Advertisement

The firm verified 52 “wrench attacks”—incidents in which criminals use violence or threats to force victims to hand over crypto—in the first half of 2026, up by a third from 39 a year earlier. Recorded financial exposure climbed almost 12-fold to $124.1 million, from $10.5 million in H1 2025, lifting the average recorded haul per incident from $270,000 to $2.39 million.

CertiK cautioned that the figures capture ransom demands and frozen or recovered assets, not just confirmed stolen value, and that under-reporting remains severe as victims fear retaliation or reputational damage.

The “defining shift,” the report says, is a surge in home invasions. From a single publicly reported case in H1 2025, break-ins have risen to 20 in the first half of 2026, about 41% of all incidents, as attackers began targeting the entire security perimeter of a victim: their residence, family, and ability to stay calm under duress. Kidnapping stayed high, rising from 12 to 16 cases, while one murder was recorded in each period.

Crypto wrench attacks around the world

Geographically, the threat has narrowed into a Western European crisis. Europe made up 75% of verified incidents, and France alone accounted for 33—roughly 64% of the global total. CertiK links France’s prominence to its large, visible crypto scene and a run of data breaches, including the France Travail and ANTS incidents, that hand attackers ready-made target lists.

CertiK also described an increasingly professional, layered model, with organizers who buy data and coordinate logistics sitting above disposable, often young operators recruited on messaging apps. Crews now assemble “target packages” from leaked databases, exchange records, and on-chain activity, making data minimization, the firm argues, a physical-safety measure.

It is also reshaping security advice. A hardware wallet or hidden seed phrase offers little protection, CertiK noted, if the owner can be forced to unlock it—pushing the firm to recommend multi-signature setups, withdrawal delays, and family “duress” protocols.

The report illustrates an ongoing trend of escalation, with wrench attacks continuing to climb year-on-year. CertiK previously recorded 72 attacks across all of 2025, a 75% jump on 2024, in a year whose most harrowing case was the January kidnapping of Ledger co-founder David Balland and his wife in France, with their captors severing one of Balland’s fingers to force a multi-million-euro ransom before police freed them.

The targeting of relatives has become a signature of the French wave. In February, authorities arrested six, including a minor, after a magistrate and her mother were abducted in a crypto ransom attempt. Months later, two teenagers were charged with attempting to abduct the wife of The Sandbox co-founder Sébastien Borget outside Paris using a fake handgun and restraints, until neighbors intervened and forced them to flee.

The scale has drawn a sweeping response. By April, French prosecutors had charged 88 suspects—more than 10 of them minors—across 12 investigations, with French ministers vowing to tackle the issue with measures to protect crypto holders, including check-ups at executives’ homes.