Crypto-related physical attacks, known as "wrench attacks," persisted through the first half of 2026, with 52 verified incidents worldwide and $124.1 million in recorded financial exposure, according to blockchain security firm CertiK. The term draws from a well-known webcomic illustrating that physical coercion can bypass even the strongest cryptography — no private key is secure if its holder can be threatened into revealing it.

The total includes stolen funds, ransom demands, frozen assets, and other values tied to documented cases, rather than only money confirmed as lost. Unlike traditional bank transfers, cryptocurrency transactions are generally irreversible, meaning funds moved under duress are extremely difficult to recover — a structural feature that makes physical coercion especially effective.

Sharp year-over-year increase

The number of attacks rose 33.3% from 39 cases in the first half of 2025. Recorded financial exposure surged far more rapidly, climbing from approximately $10.5 million a year earlier. CertiK calculated a 1,079% increase, while average exposure per incident climbed from roughly $270,000 to $2.39 million.

The first quarter drove most of the increase in attack frequency. CertiK recorded 35 incidents in Q1 2026, compared with 22 during the same period in 2025. Activity then slowed to 17 verified attacks in the second quarter, matching the Q2 2025 total.

CertiK cautioned that its financial figures are "indicative, not exhaustive." Some victims do not report attacks, while public records may not show whether ransoms were paid, recovered, or frozen. The company therefore treats the $124.1 million figure as recorded exposure rather than confirmed criminal proceeds.

The report also warned against simply doubling the first-half total to predict the full year. A repeat of the H1 pace would put 2026 near 100 verified incidents, but CertiK said the calculation is not a forecast because Q1 and Q2 showed different trends.

CertiK announced its findings on X:

The CertiK Intel3D H1 2026 Wrench Attacks Report is here. Crypto crime has gone physical. Our latest research found: • 52 verified wrench attacks (+33.3% YoY) • $124.2M in recorded exposure • Home invasions emerged as the dominant attack vector Read the full report and… pic.twitter.com/KoEAfQFMRL

— CertiK (@CertiK) July 22, 2026

France accounts for most verified wrench attacks

Europe recorded 39 of the 52 verified attacks, or 75% of the global total. France alone accounted for 33 incidents in CertiK's dataset, equal to 63.5% of all verified cases worldwide and 84.6% of Europe's total. The U.S. recorded four incidents, while Sweden and the UK each recorded two. France has one of Europe's largest crypto markets, with Paris-based exchange Blockchain.com and metaverse developer The Sandbox among prominent companies operating there, which may contribute to the concentration of high-net-worth crypto holders.

The French total may be higher than CertiK's verified public dataset suggests. The report cited France's National Directorate of Judicial Police as recording 41 incidents between January and March alone. CertiK noted that some cases can be classified as robbery, kidnapping, assault, or extortion without a clear crypto label.

France has stepped up its response to the wave of attacks. Prosecutors charged 88 suspects across 12 investigations by late April, and authorities prepared prevention measures for crypto holders following a rise in kidnappings and home invasions. Interior Minister Bruno Retailleau had previously flagged crypto-related kidnappings as a growing concern, and the French Senate moved to create a dedicated unit to investigate cryptocurrency-related crimes.

Home invasions become the leading attack method

Home invasions showed the sharpest change of any attack category. CertiK recorded 20 such incidents in H1 2026, up from one in the same period last year. The category accounted for approximately 41% of first-half attacks. Kidnappings increased from 12 to 16, while torture remained at four cases and murder at one.

Wrench attacks rely on physical force, threats, or intimidation to coerce victims into transferring crypto, revealing private keys, or unlocking wallets. This approach can bypass digital safeguards because the attacker targets the person controlling the assets rather than the wallet software itself — a vulnerability that hardware wallets, multisig configurations, and other technical protections do not fully address.

Recent cases have also involved relatives and people close to crypto holders. The wife of The Sandbox co-founder Sébastien Borget was targeted in an attempted kidnapping in France. Other reports have described attackers posing as fake delivery workers to gain access to victims.

Security spending rises as threats move offline

The increase in physical attacks has pushed some crypto companies to spend more on executive protection. Coinbase spent approximately $8.7 million on security and protection costs linked to CEO Brian Armstrong in 2025, while Gemini agreed to pay $400,000 per month for executive protection services. These figures reflect a cost category that has grown as crypto companies mature into publicly traded entities with disclosure obligations around executive safety.

MARA also disclosed $4.3 million in security spending connected to CEO Fred Thiel, including $430,000 for vehicle armoring. These costs have grown as public executives, investors, and founders face risks tied to visible crypto wealth and personal information available online.

CertiK's recommendations

CertiK advised holders to limit public information connecting their identity, location, and routines to crypto ownership. The firm recommended separating signing devices from recovery materials, using multi-party controls for large holdings, and avoiding setups in which one person can instantly move all assets under pressure.

CertiK also urged families to prepare emergency plans and advised high-risk users to keep sensitive accounts off devices used while traveling. For companies, it recommended tighter controls around employee and customer data, along with security reviews for executives, travel, and public events.

The H1 report shows that attack frequency slowed after the first quarter, but the financial value connected to known cases remained far above last year's level. France accounted for most verified cases, while home invasions became the most common attack method recorded in CertiK's dataset.