Violent, physical attacks targeting cryptocurrency holders escalated sharply in the first half of 2026, with both the number of incidents and the financial sums at stake reaching unprecedented levels, according to a new report from blockchain security firm CertiK.

The firm verified 52 "wrench attacks"—incidents in which criminals use violence, threats, or physical coercion to force victims to surrender their crypto—worldwide during the period, a 33% increase from 39 cases recorded in the first half of 2025. The term references a well-known webcomic illustrating that a $5 wrench can bypass any cryptographic protection if the attacker has physical access to the owner. Recorded financial exposure surged nearly twelvefold to $124.1 million, up from $10.5 million a year earlier, raising the average haul per incident from $270,000 to $2.39 million.

The CertiK Intel3D H1 2026 Wrench Attacks Report is here. Crypto crime has gone physical. Our latest research found: • 52 verified wrench attacks (+33.3% YoY) • $124.2M in recorded exposure • Home invasions emerged as the dominant attack vector Read the full report and… pic.twitter.com/KoEAfQFMRL — CertiK (@CertiK) July 22, 2026

CertiK cautioned that the figures encompass ransom demands as well as frozen or recovered assets, not solely confirmed stolen value. The firm also noted that under-reporting remains widespread, as victims often fear retaliation or reputational harm. While smart contract exploits and protocol hacks still account for the bulk of cryptocurrency losses each year, the report underscores physical coercion as a distinct and rapidly growing category of crypto crime—one where the target is not code but the person holding the keys.

The report identifies a surge in home invasions as the "defining shift" in the threat landscape. Break-ins climbed from a single publicly reported case in H1 2025 to 20 incidents in the first half of 2026, accounting for roughly 41% of all verified attacks. According to CertiK, attackers are now targeting the entire security perimeter of a victim—their residence, their family members, and their psychological composure under duress. Kidnappings remained elevated, rising from 12 to 16 cases year-over-year, while one murder was recorded in each period.

Geographic Concentration in Western Europe

The threat has narrowed into what CertiK describes as a Western European crisis. Europe accounted for 75% of all verified incidents, with France alone responsible for 33 of the 52 cases—approximately 64% of the global total. CertiK attributes France's prominence to its large and visible crypto community, compounded by a series of data breaches, including the France Travail and ANTS incidents, which exposed personal data on tens of millions of French residents and provided attackers with ready-made target lists. France is also home to major crypto industry companies, including hardware wallet manufacturer Ledger and virtual world platform The Sandbox, making it a particularly target-rich environment.

Increasingly Professional Operations

CertiK detailed an increasingly sophisticated, layered operational model. Organizers who purchase stolen data and coordinate logistics sit atop a network of disposable, often young operators recruited through messaging applications. These crews assemble "target packages" drawing on leaked databases, cryptocurrency exchange records, and on-chain activity—a development that, in CertiK's view, makes data minimization a matter of physical safety rather than merely digital privacy.

This reality is also reshaping security guidance. A hardware wallet or concealed seed phrase offers limited protection, CertiK noted, if the owner can be physically compelled to unlock it. The firm now recommends multi-signature setups, withdrawal time-lock delays, and family "duress" protocols as more effective deterrents—measures designed to remove the ability to transfer funds even under threat, rather than relying on the victim's willpower to resist coercion.

Pattern of Escalation

The report reinforces a sustained upward trend. CertiK previously documented 72 wrench attacks across all of 2025, a 75% increase over 2024. The most harrowing case of that year was the January kidnapping of Ledger co-founder David Balland and his wife in France, during which captors severed one of Balland's fingers to coerce a multi-million-euro ransom before police secured their release.

The targeting of relatives has become a hallmark of the French wave. In February, authorities arrested six individuals, including a minor, following the abduction of a magistrate and her mother in a crypto ransom attempt. Months later, two teenagers were charged with attempting to kidnap the wife of The Sandbox co-founder Sébastien Borget outside Paris, armed with a fake handgun and restraints, before neighbors intervened and forced the assailants to flee.

The scale of the crisis has prompted a sweeping law enforcement response. By April, French prosecutors had charged 88 suspects—more than 10 of them minors—across 12 separate investigations. French ministers pledged to address the issue with measures designed to protect crypto holders, including security check-ups at executives' residences. Whether such measures can counter what CertiK describes as a professionalized, data-driven extortion economy—operating across borders with an expanding pool of recruits—remains the central question as the second half of 2026 unfolds.