CertiK reports $124M surge in wrench attacks

TLDR

CertiK has confirmed a sharp rise in wrench attacks, with about $124 million in assets exposed across 52 physical assaults on crypto holders in the first half of 2026.

1. CertiKs H1 2026 data shows wrench attacks up roughly one third year over year, with Europe, especially France, accounting for most incidents.
2. These attacks bypass technical defenses by targeting people directly, exploiting public links between real?world identities and large crypto holdings.
3. Crypto users should fold physical and operational security into their risk management, watching both attacker tactics and regulatory responses.

Deep Dive

1. Scale Of Wrench Attacks

CertiKs mid?year report found 52 confirmed wrench attacks in H1 2026, up from 39 in H1 2025, a 33.3 percent increase, with roughly $124.1 million in value exposed across the cases. That figure includes ransom demands, victim payments, and assets later frozen by authorities or service providers, so not all funds were permanently lost, but the exposure is far higher than the roughly $10.5 million seen a year earlier.

Europe is the clear hotspot. France alone accounts for 33 of the 39 European incidents, making it the epicenter of these threats, according to CertiKs H1 2026 summary. Home invasions linked to crypto rose from 1 to 20 cases, kidnappings from 12 to 16, with torture and murder cases holding steady but still present. Most incidents clustered in early 2026, then tapered slightly as security and law?enforcement responses improved.

Confidence: high - multiple independent reports cite the same CertiK dataset and numbers.

2. Why This Changes The Risk Picture

Wrench attacks are physical coercion against crypto holders to force transfers, unlock wallets, or surrender private keys. They effectively ignore strong digital security by attacking the person instead of the system, which makes them a threat even to technically sophisticated users. CertiK stresses that those with public profiles or traceable on?chain wealth are at particular risk.

This sits alongside a broader shift in attack patterns. A separate H1 2026 analysis found total crypto losses around $1.32 billion, with wallet compromises the single largest method in Q2, accounting for about $807.5 million, per broader CertiK loss data. Regulators are also reacting: Vietnams new crypto decree, which references a surge in wrench attacks, targets misuse of account data and KYC failures, as reported in Vietnams new crypto decree.

3. Practical Safeguards And What To Watch

CertiK recommends basic but important operational changes for wealthier or public crypto users. These include disconnecting public identity from major holdings, ensuring no single person can move large balances alone, improving home security, having family emergency plans, and limiting mobile access to sensitive wallets while traveling, as outlined in the H1 2026 recommendations.

Looking ahead, useful signals to monitor are:

1. New reports from CertiK and other firms on physical incidents and wallet compromises.
2. Regulatory moves on data privacy, custodial standards, and key management, especially in Europe and Asia.
3. Changes in institutional custody and insurance requirements, which may increasingly favor multi?party controls and reduced personal key exposure.

Conclusion

The $124 million surge in wrench attacks shows that crypto security is no longer just a technical problem. As more wealth moves on?chain and more holders are identifiable, physical coercion and operational failures become central risks. Treating identity exposure, key sharing, and home security as part of a single risk framework is likely to matter as much as choosing the right chain or protocol.