Physical Crypto 'Wrench Attacks' on Pace for Record Year with $30M Stolen in First Half of 2026, Chainalysis Reports
Key Takeaways
- •Chainalysis documented 46 violent crypto attacks through late June 2026, with more than $30 million stolen in the first half of the year.
- •Kidnappings remain the most common attack type, but home invasions rose to 37% of documented incidents in 2026 from 26% in 2023.
- •Attackers are increasingly using relatives and acquaintances of crypto holders to pressure victims into transferring funds.
- •France recorded 30 incidents through mid-2026, more than any other country, and Chainalysis linked the rise to a possible tax-record breach.
- •The report said stolen crypto is difficult to recover because transfers are irreversible and can be moved through a range of centralized and decentralized platforms.

Violent physical attacks targeting cryptocurrency holders are on pace for their worst year on record, with more than $30 million stolen during the first half of 2026, according to a new report by blockchain analytics firm Chainalysis.
Published on Thursday, the report documented 46 violent crypto attacks through late June. These incidents — sometimes referred to as "wrench attacks" in security circles, a term popularized by a well-known webcomic illustrating that physical coercion can bypass even the strongest cryptography — involve the use of threats or physical violence to force victims into handing over cryptocurrency.
"Violent attacks targeting crypto holders, including home invasions, kidnappings, and hostage situations, sometimes called 'wrench attacks' in security circles, have surged in recent years," Chainalysis wrote. "Criminals have recognized that crypto holders are high-value targets because they possess wealth in an instantly and irreversibly transferrable form."
Unlike traditional bank transfers, cryptocurrency transactions cannot be reversed, and no fraud department or deposit insurance can recover funds once a victim is compelled to authorize a transfer — a structural feature of blockchain-based money that makes these crimes especially difficult to address after the fact.
While kidnappings remain the most common type of attack, home invasions have become increasingly frequent, rising to 37% of documented incidents in 2026 from 26% in 2023. Chainalysis attributed this shift to the practical advantages home invasions afford attackers.
"Home invasions allow criminals to confront victims in a controlled environment where they can compel a transfer of funds," the firm wrote. "Kidnappings, by contrast, are much more difficult to execute. Attackers must expend considerable time and resources planning logistics; and the extended periods spent with victims leaves the attacker exposed for longer."
Chainalysis also found that attackers are increasingly targeting relatives and acquaintances of crypto holders as a means of pressuring victims into transferring funds — a tactic that broadens the population at risk beyond those who directly hold digital assets.
France has emerged as a major center for these attacks, recording 30 incidents through mid-2026 — more than any other country. Chainalysis said the increase appears connected to an alleged breach involving tax records that exposed information about high-net-worth crypto holders.
The report identified significant variation in how attackers launder stolen funds. Some demonstrate only a basic understanding of cryptocurrency, moving stolen assets directly to centralized exchanges without attempting to conceal their trail. Others employ more sophisticated techniques.
"Mid-tier attackers demonstrate greater familiarity with crypto infrastructure. They may use decentralized exchanges, bridges, MEV bots, and other DeFi tools to swap and move assets across chains," Chainalysis wrote. "They understand that centralized exchanges represent chokepoints with sophisticated compliance programs and user KYC, and attempt to avoid or delay interaction with them."
The findings come amid a continued escalation in violent attacks against crypto holders. In February, blockchain security firm CertiK reported that wrench attacks climbed 75% in 2025 to a record 72 incidents, with France emerging as the epicenter. In April, French authorities charged 88 suspects, including more than 10 minors, across 12 investigations as part of an expanded crackdown on organized gangs behind the wave of attacks. In June, French authorities indicted a man accused of participating in a crypto wrench attack after allegedly posing as a police officer.
In July, CertiK reported that financial exposure from wrench attacks reached $124 million in the first half of 2026. This week, five men were convicted in London of imprisoning and torturing two French crypto millionaires in an extortion scheme.
Beyond Europe, Bitcoin ransom demands have also drawn national attention in the United States. Earlier this year, ransom notes demanding Bitcoin surfaced during the investigation into the kidnapping of Nancy Guthrie, the mother of "Today" host Savannah Guthrie.