Physical attacks against cryptocurrency holders increased 33.3% worldwide in the first half of 2026, with total financial exposure surging roughly 11.8-fold to an estimated $124.1 million, according to CertiK's newly released Intel3D: H1 2026 Wrench Attacks Report. The blockchain security firm verified 52 incidents globally during the period, up from 39 in the first half of 2025.

The report's central finding is not the rising incident count alone, but a pronounced tactical shift: home invasions have overtaken kidnapping as the predominant method of attack. Home invasions climbed from a single publicly reported case in H1 2025 to 20 verified cases in H1 2026, accounting for approximately 41% of all incidents. Kidnapping, while remaining a significant tactic, rose more modestly from 12 to 16 cases.

Improved Wallet Security Redirects Attackers Toward People

CertiK attributes this shift to advancements in wallet security. As multisig setups, hardware wallets, and cold storage solutions have made remote hacking increasingly difficult, attackers have pivoted toward targeting individuals who hold the keys directly. The term "wrench attack" itself long predates this report — it references a widely known principle in security circles, popularized by a 2010 webcomic, that no matter how strong one's cryptography is, an attacker with physical access and coercion can bypass it entirely. A home invasion compromises a victim's entire security perimeter simultaneously — residence, family, device access, and psychological composure — in ways that a remote hack cannot replicate.

Europe accounted for 39 of the 52 incidents, representing 75% of the global total. France alone recorded 33 incidents, or 63.5% of all cases worldwide. The United States documented 4 incidents, while Sweden and the United Kingdom each recorded 2.

Leaked Personal Data Fuels Target Selection

A major focus of the report is how attackers identify and profile their targets. CertiK highlights an expanding "data supply chain" comprising leaked databases, tax records, exchange data, and social media activity, all used to construct detailed victim profiles before making physical contact.

Specific cases cited in the report include a French tax administration employee allegedly selling investor data to criminal networks, and an extortion attempt that crypto exchange Kraken disclosed involving malicious insiders within its client-support environment.

The report reframes personal data exposure — beyond wallet security alone — as a direct physical safety risk for cryptocurrency holders. This framing connects a threat vector that the crypto industry has historically treated as a digital privacy concern to consequences in the physical world.

Organized Criminal Networks Behind the Attacks

CertiK describes a layered criminal model driving many of the incidents. The structure involves organizers who source victim data and coordinate logistics, local recruiters, and ground-level operators — frequently young men recruited through messaging applications, some of whom are themselves coerced into participating.

French authorities have made approximately 200 arrests since January in connection with crypto-linked kidnapping and extortion cases. Several dozen of those arrested were identified as minors.

CertiK attributes France's disproportionate concentration of crypto-related crime to its highly visible crypto ecosystem, combined with recent data breaches at institutions including France Travail and ANTS, which may have significantly expanded the pool of identifiable targets. France has positioned itself as one of Europe's most prominent crypto hubs, with Paris hosting major exchange operations and a large base of retail investors — factors that, combined with institutional data leaks, may help explain the country's outsized share of incidents.

Security Recommendations

For individuals and families, CertiK recommends reducing exposure by removing wallet addresses, portfolio screenshots, home details, travel plans, and other public indicators of wealth. The firm advises separating wallets, securing long-term holdings through multisig or MPC systems, implementing withdrawal controls, and storing recovery materials separately from signing devices. Families are also encouraged to establish emergency procedures, strengthen home security, and avoid carrying sensitive wallet access on everyday devices.

For founders and high-profile holders, the report recommends conducting personal risk assessments, eliminating single-person control over treasuries and critical systems, and verifying meetings, travel, and public appearances. It further advises reviewing past online content for leaked personal information and developing response plans in coordination with legal, security, and custody partners.

For institutions and wallet providers, CertiK emphasizes reducing human points of failure through multi-party controls, limited data exposure, and stronger insider monitoring. The firm recommends that wallet providers build in safeguards such as emergency freezes, spending limits, safer recovery options, and privacy-focused default settings.

Broader Implications

The pivot toward home invasions demonstrates that as on-chain security improves, attackers are increasingly targeting the physical safety of cryptocurrency holders. This development reframes personal data protection as a security issue with direct physical consequences for the broader crypto community. The trend also suggests that the security investments the industry has made in protocol-level and wallet-level defenses are working as intended against remote adversaries — and that the remaining attack surface is increasingly human.