On July 23, 2026, blockchain security firm CertiK published its Intel3D Wrench Attacks Report for the first half of 2026, documenting a significant escalation in physical coercion attacks targeting cryptocurrency holders. The report recorded 52 verified incidents worldwide, resulting in approximately $124.1 million in losses.

Physical coercion attacks against crypto holders—commonly known as "wrench attacks"—involve perpetrators using violence, abduction, or threats against holders and their associates to compel wallet transfers or private key disclosure. The term traces to a widely circulated webcomic illustrating that cryptographic security can be bypassed not through technical sophistication but through blunt physical force. According to CertiK's findings, these attacks have shifted from a relatively niche threat to a focused, high-stakes criminal enterprise. The 52 verified incidents represent a 33.3% increase from the 39 cases recorded in the first half of 2025. Financial losses surged even more dramatically, rising 11.8 times from $10.5 million in the comparable 2025 period to $124.1 million in H1 2026. The reported loss figure encompasses ransom payments, completed thefts, asset relocations, frozen or recovered assets, and failed extortion attempts, providing a comprehensive view of attempted extractions.

Data Breaches Fuel Targeted Home Invasions

The report attributes the rise in crypto-related home invasions to the increasing availability of personal data, which has allowed criminals to identify and target high-value cryptocurrency holders with greater precision. The proliferation of identity-linked databases—including those generated by know-your-customer (KYC) and anti-money-laundering (AML) compliance requirements at exchanges and custodians—has expanded the surface area for data leaks that can expose holders' real-world identities and addresses. Home invasion incidents jumped from one in the previous period to 20 in H1 2026, while kidnappings increased from 12 to 16.

CertiK researchers found that attackers have moved away from opportunistic street robberies—which declined from five incidents to one—in favor of more sophisticated methods. These include data-driven targeting, coercion of family members and other proxies, and organized transnational operations.

France Emerges as Global Epicenter

Geographically, the threat has become heavily concentrated in Europe, which accounted for 39 of the 52 recorded incidents. France alone reported 33 incidents, representing nearly two-thirds of the global total and making it the clear epicenter of crypto-related physical attacks.

France's concentration of incidents follows a series of high-profile cases that drew national attention in 2025, including the January 2025 abduction of Ledger co-founder David Balland and his partner at their home, and separate kidnapping and extortion attempts targeting other crypto entrepreneurs and their family members in the Paris region. These incidents prompted French authorities to establish a specialized unit dedicated to cryptocurrency-related kidnappings.

French authorities documented 77 cases of crypto-linked kidnappings, extortions, or attempted incidents in H1 2026, a sharp increase from 45 cases for the entirety of 2025.

Projections for the Second Half of 2026

CertiK's report outlines several factors that could influence attack trends in the remainder of 2026, including the interplay between law enforcement efforts, evolving criminal tactics, and market visibility. The report notes that if the first-half pace continues, verified incidents could approach 100 by year-end, with total recorded exposure exceeding $228 million.

The report suggests Europe may experience renewed activity, particularly around industry conferences, market rallies, or additional data-leak revelations. Criminal organizations may also expand operations beyond France into jurisdictions with less developed enforcement capabilities.

Attackers are expected to continue leveraging proxy victims—including relatives, employees, drivers, and assistants—to exert pressure on primary targets. The report also warns that databases linking identities, home addresses, and cryptocurrency holdings could become increasingly valuable commodities in underground markets.

According to CertiK, the visibility of crypto holders, rather than the price of Bitcoin, will remain the primary factor shaping future attack trends.

Source: CertiK Intel3D Wrench Attacks Report, H1 2026