Physical crypto attacks surge as $124M stolen

TLDR

Physical attacks on crypto holders have risen sharply in 2026, with about $124 million in assets exposed in 52 wrench incidents worldwide, led by Europe.

1. CertiK data show a 33 percent year on year jump in confirmed physical attacks and a near tenfold increase in value at risk, with France a major hotspot.
2. These crimes focus on coercing victims to unlock wallets, including home invasions and kidnappings, bypassing strong on-chain and exchange security controls.
3. Users should watch for more law-enforcement action and adopt stricter privacy and physical-security practices, as underreported incidents and copycat crimes could extend the trend.

Deep Dive

1. Scale And Geography

A July 2026 report by blockchain security firm CertiK found 52 confirmed physical attacks on crypto holders in the first half of 2026, up from 39 a year earlier, with about $124.1 million in assets exposed in those incidents. The average exposure per case jumped from roughly $270,000 to about $2.39 million, showing that attackers are targeting larger holdings, not just small retail balances.

Europe accounts for most documented cases, with France alone recording 33 incidents out of 39 in the region, including a sharp rise in home invasions linked to crypto holdings. These figures come from a detailed physical attacks report and are echoed in wider coverage of violent crypto wrench attacks. CertiK notes that some of the $124 million figure reflects ransom demands and assets later frozen, so not all funds are permanently lost, and the true scale is likely higher due to underreporting.

2. How Wrench Attacks Work

Wrench attacks are crimes where aggressors use threats or violence to force victims to unlock wallets, reveal seed phrases, or authorize transfers on phones and laptops. CertiKs data show patterns that include home invasions, kidnappings, torture cases, and at least one murder, all tied to extorting digital assets.

These attacks often target people whose crypto wealth is publicly visible, such as founders, traders, or influencers, or those whose holdings are known in local circles. Once criminals have physical control over a victim or their devices, traditional digital protections like hardware wallets, multisig, or exchange security are much less effective if the victim can be coerced to cooperate.

3. What To Watch And Do

While physical attacks are rising, law enforcement is also escalating its response to crypto crime. In parallel with wrench incidents, US authorities have moved to seize over $25 million in crypto tied to international romance and investment scams, as part of the Scam Center Strike Force described in recent DOJ-focused coverage. This shows regulators and agencies are increasingly treating crypto-related crime, both physical and online, as a priority.

CertiKs guidance for individuals includes disconnecting public identity from large holdings, splitting high-value assets across structures where no single person can move everything, improving home security, planning family responses to coercion, and avoiding mobile access to sensitive wallets while traveling. These are practices many security-focused users already follow to reduce the payoff and difficulty of physical extortion attempts.

Conclusion

Physical crypto attacks are becoming a meaningful part of the risk landscape, shifting some focus from exploits and scams to direct threats against individuals. The data so far point to concentrated hotspots, larger targets, and probable underreporting, even as enforcement and guidance improve. For crypto users, the practical shift is to combine good digital hygiene with conscious control of personal exposure, location, and key management so that both software and human vulnerabilities are addressed.

Confidence: high. Multiple independent outlets summarise the same CertiK dataset and related enforcement actions from mid 2026.