Global losses from so-called “wrench attacks” — violent, physical coercion used to seize crypto holdings — totaled an estimated $101 million in the first four months of 2026, Web3 security firm CertiK reports. With 34 verified incidents worldwide so far this year, the total losses are nearly double the $52.2 million recorded for all of 2025, and Europe has borne the brunt: roughly 82% of incidents occurred there.
What is a wrench attack?
Wrench attacks are crimes that use force or threats — home invasions, kidnappings, impersonations and extortion — to force victims to reveal private keys, seed phrases, passwords or to transfer assets. Since 2025 their frequency has risen, and CertiK warns the pattern has shifted from Asia and North America toward a European concentration in early 2026.
France as an epicenter
France stands out: CertiK attributes 24 of the year’s 34 verified attacks to France, while French authorities report an even higher count — 47 incidents in 2026. Investigators point to several contributing factors in France: the presence of executives from major crypto firms, public profiles of wealthy holders, repeated data breaches, and cultural habits of “flexing” crypto wealth or sharing identifying information online.
Data-driven targeting
CertiK describes a shift to data-driven targeting: once attackers obtain a victim’s name, home address and financial profile from leaks or illicit sales of data, elaborate tails and long-term physical surveillance become unnecessary. High-profile breaches and alleged sales of customer lists have provided attackers with the information they need to single out targets, making physical coercion a more straightforward, economically attractive attack path when wallet security improves.
How attacks are carried out
Typical attack teams are small (three to five people), often assembled remotely and operated by organizers who may be based outside the victim’s country. On the ground, perpetrators commonly pose as delivery drivers or law enforcement, or trick victims into meetings to ambush them. Many foot soldiers are recruited through messaging apps such as Telegram or Snapchat for relatively small sums; CertiK characterizes them as “complete amateurs” who frequently do not know one another.
Other trackers and cases
Blockchain intelligence firms have flagged similar trends: the purported pseudonymity of crypto, visible displays of wealth and the ease of harvesting personal data online make crypto holders attractive targets. Jameson Lopp, chief security officer at Casa, has independently tracked dozens of physical crypto attacks this year and noted some incidents involved mistaken identity, where thieves targeted the wrong people.
Legal response and criminals’ profiles
Authorities in France have taken action: at least 88 people, including minors, were indicted in connection with alleged wrench attacks on crypto owners. The involvement of younger offenders is notable to investigators, seen as an attempt by criminal networks to externalize liability onto profiles less likely to receive long mandatory sentences.
What’s next
If current trends hold, CertiK warns the total number of wrench attacks could reach about 130 by year-end, with losses climbing into the “several hundred million dollars” range. The firm’s main takeaway: as protocols and wallets get more secure, attackers are shifting focus to the human element — exploiting exposed personal data and using physical coercion to bypass technical safeguards.
Mitigation and personal security
Practical steps for crypto holders include minimizing public exposure of holdings and personal identifying information, tightening operational security (how private keys and backup phrases are stored), using cold storage where appropriate, and practicing discretion about wealth online. Organizations and individuals should also push for better protection and oversight of customer data to limit leakage channels that enable targeted physical attacks.
Cointelegraph’s note
This rewritten summary is based on reporting of CertiK’s findings and other industry trackers. Readers should consult original reports and law enforcement sources for full details and ongoing updates.