Crypto wrench attacks stole more than $30 million from digital asset holders during the first half of 2026, according to a Chainalysis report released on Thursday. The blockchain analytics firm placed total financial exposure at $107 million, a figure that encompassed completed thefts as well as attempted, blocked, and recovered transfers.

If the current pace continues, losses could exceed the $58 million stolen throughout all of 2025, Chainalysis warned. The final outcome will depend on attack activity during the remainder of 2026. The trend highlights an inherent tension in self-custody: holding assets outside regulated exchanges removes counterparty risk but concentrates security entirely on the individual, making holders identifiable targets for physical coercion.

While most crypto crime unfolds online, physical violence against holders is accelerating. With $30M already stolen in 2026, "wrench attacks" and home invasions are on pace for a record year, with France emerging as the primary global hotspot. Read our new research for a… pic.twitter.com/ilJiOyJtLy — Chainalysis (@chainalysis) August 6, 2026

CertiK Reports 52 Verified Attacks and $124M Exposure

CertiK, a blockchain security firm, corroborated the trend in its own H1 2026 Wrench Attacks Report, published on July 22. The firm documented 52 verified attacks during the first six months of the year — a 33% increase from the 39 cases recorded in the same period of 2025.

CertiK estimated total financial exposure at over $124 million, a figure that included ransom demands and coerced transfers even in cases where attackers failed to retain the funds.

The CertiK Intel3D H1 2026 Wrench Attacks Report is here. Crypto crime has gone physical. Our latest research found: • 52 verified wrench attacks (+33.3% YoY) • $124.2M in recorded exposure • Home invasions emerged as the dominant attack vector Read the full report and… pic.twitter.com/KoEAfQFMPL — CertiK (@CertiK) July 22, 2026

What Makes Wrench Attacks Distinct

Crypto wrench attacks involve violence, threats, or coercion directed at cryptocurrency holders or their relatives. Criminals force victims to reveal private keys or seed phrases, or demand that victims authorize wallet transfers. The term originates from a well-known security concept in which an attacker bypasses sophisticated cryptography simply by threatening the key holder with a blunt instrument — illustrating that the weakest link in any security system is often the human, not the code.

Unlike online hacks and scams that exploit code vulnerabilities or rely on social engineering over the internet, wrench attacks target people and homes directly. This approach allows criminals to bypass the technical protections that safeguard self-custodied digital assets. Hardware wallets and multi-signature arrangements, which require multiple approvals before funds can move, have been widely promoted as risk-reduction measures, though attackers can still coerce holders into authorizing transfers under duress.

Data Leaks Put French Crypto Holders at Risk

France emerged as the leading global hotspot for these attacks. Chainalysis recorded 30 publicly known incidents in the country through mid-2026. French Interior Minister Laurent Nuñez disclosed that authorities had registered at least 70 cases of violence connected to cryptocurrencies.

Such criminal activity was limited in France before 2025. The surge followed a 2024 hack involving a tax inspector who allegedly leaked dossiers containing names, addresses, and cryptocurrency holdings of wealthy individuals.

A separate breach affected Waltio, a crypto tax-reporting company. That incident exposed information tied to approximately 50,000 users, further expanding the pool of individuals identifiable as potential targets. The French cases illustrate how third-party data custodials — tax authorities, reporting services, and other intermediaries — can become inadvertent attack-enabling vectors even when the underlying blockchain remains secure.

Attackers Target Holders and Their Families

Home invasions accounted for 37% of crypto wrench attacks in 2026, a sharp increase from prior years, while kidnapping remained the predominant form of assault. Criminals showed a preference for targeting relatives of cryptocurrency holders and using them as leverage.

Chainalysis classified attackers into three categories based on their on-chain behavior. Opportunistic criminals transferred stolen assets directly to exchanges, while more sophisticated actors relied on cross-chain bridges and cryptocurrency mixers to obscure the movement of funds.

The firm also examined five cases in India where the victim's residence could be determined. Local residents made up 80% of the victims in those cases, with tourists and expatriates comprising the remaining 20%. India followed the same pattern observed across most countries in the report: cryptocurrency holders, rather than tourists, served as the primary targets. The Netherlands was the only country that deviated from this trend.