Crypto wrench attacks—physical violence or coercion used to force cryptocurrency holders into transferring assets—have emerged as a major security concern for the digital asset sector, according to CertiK's H1 2026 Wrench Attacks Report. The report said physical attacks targeting cryptocurrency holders increased sharply during the first six months of 2026, highlighting risks that extend beyond online exploits and smart contract vulnerabilities. Unlike most cyberattacks, these incidents exploit the human custodian rather than a software flaw, and the irreversible nature of blockchain transactions means that once funds are transferred under duress, recovery is extremely difficult.

Verified incidents and reported exposure climbed in H1 2026

CertiK said 52 verified wrench attacks were recorded worldwide in H1 2026, up from 39 incidents during the same period a year earlier. That represents a 33% increase in verified cases compared with H1 2025.

The financial exposure tied to those incidents also increased substantially. According to the report, recorded exposure rose from approximately $10.5 million in H1 2025 to $124.1 million in H1 2026. CertiK said this figure includes reported losses and ransom demands, and should not be interpreted as confirmed criminal profits.

Home invasion cases also rose markedly. CertiK recorded one publicly reported home invasion incident in H1 2025, compared with 20 such incidents in H1 2026.

The company emphasized that its figures cover publicly verified incidents and recorded exposure. It also noted that underreporting may mean the actual scale of wrench attacks is significantly higher than the available data indicates.

Europe accounted for most verified cases

CertiK's report showed a significant geographical concentration in Europe. The region accounted for 39 of the 52 verified wrench attacks recorded during the first half of 2026.

France had the highest number of verified cases in CertiK's dataset, with 33 incidents. The report said the concentration of cases may be connected to several factors, including Europe's large cryptocurrency ecosystem, the availability of public information that could help identify potential targets, and stronger public reporting of such incidents. Public blockchain ledgers, social media activity, and regulatory disclosure requirements can all create pathways for attackers to identify and locate high-net-worth cryptocurrency holders.

CertiK did not attribute the pattern to a single cause. Instead, the report presented the data as evidence that physical threats against cryptocurrency holders have become increasingly concentrated in Western Europe.

Custody controls remain a focus

The report said wallet security alone may not be sufficient to prevent every wrench attack, particularly when attackers use physical coercion against asset holders. CertiK recommended custody arrangements designed to reduce the ability of one person to move large amounts of cryptocurrency while under duress.

Suggested measures include multi-party approvals, withdrawal delays, transaction limits, and staged custody structures. CertiK said such controls can slow unauthorized transfers and create additional time for response when an incident occurs.

As physical coercion becomes a more visible risk for crypto holders, the security discussion is expanding beyond software, private keys, and smart contracts. CertiK's findings indicate that protecting digital assets increasingly involves safeguards for both wallets and the people who control them.