Crypto-related home invasions rose from one publicly reported case in the first half of 2025 to 20 in the same period of 2026, according to CertiK's Intel3D H1 2026 Wrench Attacks report.

CertiK said it verified 52 physical coercion incidents worldwide in H1 2026, compared with 39 a year earlier. Kidnappings increased from 12 to 16, while recorded financial exposure climbed from approximately $10.5 million to $124.1 million.

The figures show a sharp increase in publicly verified cases, but they do not support a simple claim that home invasions became precisely 20 times more common across the entire crypto market. The H1 2025 baseline was only one reported case, and CertiK's methodology captures incidents that can be independently verified rather than every incident that may have occurred.

CertiK's data also does not include an average exposure per incident. Dividing $124.1 million by 52 would produce approximately $2.39 million, but the available evidence does not show that this figure resembles a typical case.

Home invasions became a major category in verified wrench attacks

A wrench attack involves violence, intimidation or a credible threat used to force a person to transfer cryptocurrency, disclose credentials, unlock a device or pressure another person into complying.

Home invasions accounted for approximately 38.5% of CertiK's verified H1 2026 incidents. The category moved from a marginal share of the previous comparison period to one of the dominant attack types in the dataset.

CertiK said it kept the general taxonomy used in its 2025 report and added only "Forced Crypto Transfer" as a clearer label for immediate transfers conducted under threat outside the broader context of a kidnapping, ransom or home invasion. That reduces the likelihood that the increase was caused by a newly invented or substantially broadened home-invasion category.

The change indicates that the visible threat pattern shifted. It does not prove that home invasions rose exactly 20-fold across the whole crypto sector. CertiK includes only incidents it can verify through sources such as police statements, court documents, victim testimony, on-chain evidence or corroborated reporting.

The report's totals are therefore a measure of the visible and independently verifiable portion of the problem. Victims may avoid public disclosure because of fear, privacy concerns or an active investigation. Police may also record a case as robbery, assault or kidnapping without publicly identifying a crypto connection.

Lopp database points in the same direction

An independent public database maintained by Jameson Lopp provides a separate point of comparison. Lopp, the co-founder and chief security officer of Bitcoin custody company Casa, has maintained a public log of physical Bitcoin and crypto attacks for years.

The database contained 46 entries dated between January 4 and June 29, 2026. That count is broadly consistent with CertiK's conclusion that physical attacks were not isolated events during the period.

The two datasets should not be combined or treated as directly competing measurements. Lopp's log includes attempted attacks, mistaken targeting and situations that may fall outside CertiK's narrower dominant-category methodology. One entry, for example, involved attackers who expected cryptocurrency but found that the victim did not hold any.

Both datasets also state or demonstrate that they are incomplete. Their strongest overlap is directional: publicly documented physical attacks occurred repeatedly across several countries in H1 2026, with a particularly dense cluster in France.

Outliers drove the $124.1 million exposure figure

CertiK's verified incident count increased by 33.3% year on year, while recorded financial exposure rose by approximately 1,079%. That gap is more informative than an average produced by dividing total exposure by the number of incidents.

The increase indicates that a small number of very large cases accounted for a disproportionate share of the financial exposure.

In March, the pseudonymous game developer Sillytuna reported being forced to transfer approximately $23.6 million in an Aave USDC position, according to Protos. USDC is a U.S. dollar-pegged stablecoin, and the position represented funds deposited into Aave, a decentralized lending protocol on which users can earn interest or borrow against crypto collateral.

That single incident represented approximately 19% of CertiK's total H1 2026 exposure figure.

CertiK did not publish a median amount or a full distribution showing the value associated with each case. Without that information, the report supports the conclusion that the largest attacks became financially severe, but it does not establish the amount involved in a typical incident.

The $124.1 million total also should not be read as confirmed criminal proceeds. CertiK's figure includes disclosed losses, ransom demands, frozen or recovered funds and partially reported amounts. It excludes costs that are difficult to quantify, including medical treatment, relocation, security changes, interrupted work and long-term harm to victims and their families.

Cases show that attackers target people, not only cryptography

In another March incident, three attackers posing as police reportedly entered a couple's home in Le Chesnay-Rocquencourt, near Paris. According to Le Parisien, the victims were threatened and forced to transfer approximately €900,000 in bitcoin.

The attackers did not need to extract a seed phrase from encrypted hardware or exploit a software vulnerability. They needed access to the people who could approve the transaction.

That distinction changes the security question. A hardware wallet may protect a private key against malware or remote theft, but it does not eliminate the risk created when one identifiable person can immediately authorize movement of the entire balance. Multi-signature wallets, which require approvals from multiple devices or co-signers before funds can move, and time-lock mechanisms that delay withdrawals are among the approaches the crypto custody industry has developed to address single-point-of-failure risk. Casa, where Lopp serves as chief security officer, is among the companies that build such custody products for individual holders.

France dominated the publicly verified cases

Europe accounted for 39 of CertiK's 52 verified cases, and France alone accounted for 33.

France may have experienced an exceptional concentration of crypto-related violent crime. It may also be unusually capable of identifying, tracking and publicly disclosing the crypto connection in such cases.

The Gendarmerie nationale reported 77 kidnappings and unlawful confinement cases connected with the crypto sector by July 7, 2026, according to an official Gendarmerie publication. CertiK's lower total reflects a narrower methodology limited to cases it could independently verify, so the two figures are not directly interchangeable.

A dedicated official count gives researchers a larger pool of incidents to identify and verify. Countries that do not routinely disclose a crypto motive may appear safer in international datasets even when similar crimes are recorded under broader categories.

Visibility is unlikely to explain the full concentration. France has a substantial and public crypto industry, frequent industry events and a visible population of founders, investors and service providers. Personal information available through administrative systems, data breaches and open online sources may make some targets easier to identify.

France's data regulator, the CNIL, fined France Travail after finding that attackers had accessed information including postal addresses, email addresses, telephone numbers and social security numbers.

There is no evidence linking that breach to any specific wrench attack. The case illustrates how leaked identity data can be combined with public blockchain activity, company biographies, social media posts or property information to build a more detailed target profile.

Online information can help build physical targets

A physical attack may occur at a home, hotel or meeting point, but preparation can begin online.

A target profile may include a home address, family relationships, employment details, conference appearances, estimated holdings, wallet addresses, phone numbers, vehicles and predictable travel routines.

Unlike a traditional bank account, whose balance is visible only to the account holder and the financial institution, a public blockchain records every transaction and current balance on an open ledger accessible to anyone with an internet connection. Blockchain analytics tools have made it increasingly feasible to link wallet addresses to real-world identities, particularly when individuals have disclosed wallet activity on social media or in public company materials.

A portfolio screenshot therefore carries a different risk from a general market comment. It can connect a real identity with perceived wealth. Live location posts and public travel schedules can then reveal when and where the person, or their relatives, may be accessible.

The increase in home invasions does not show that every crypto holder faces the same threat. It shows that security assumptions focused only on remote hacking are incomplete when holdings are large, publicly associated with an individual and immediately movable by that person.

Methodology: Incident figures, definitions and methodological notes were compared directly with CertiK's H1 2026 report. CertiK's dataset was cross-checked against Jameson Lopp's independently maintained public log of physical crypto attacks. France-specific figures were checked against official Gendarmerie and CNIL publications, while individual incidents were checked against contemporary reporting. Sources were reviewed on July 25, 2026.

This article is for informational and security-awareness purposes only. It does not provide personalized custody, legal or physical-security advice. Anyone facing an immediate threat should prioritize personal safety and contact the competent emergency services as soon as circumstances allow.