Crypto wrench attacks surge to $124M losses

TLDR

Physical wrench attacks against crypto holders have risen in 2026, with CertiK estimating around $124 million in assets exposed across 52 incidents in the first half of the year.

1. CertiKs latest data shows a 33 percent year over year rise in wrench attacks, with average exposure per incident jumping to about $2.39 million.
2. Most recorded cases are in Europe, especially France, and involve home invasions, kidnappings and violent coercion aimed at extracting keys or forcing transfers.
3. The trend expands crypto risk from purely digital to personal security, making privacy about holdings and robust custody setups critical to reduce exposure.

Deep Dive

1. Scale Of The Wrench-Attack Problem

Blockchain security firm CertiK reports 52 confirmed wrench attacks against crypto holders in the first half of 2026, up from 39 in the same period of 2025, a rise of about 33 percent. The total value at stake in these incidents is roughly $124.1 million, including ransom demands, victim payments and assets later frozen by authorities or service providers, so not all of that amount became permanent losses. Average exposure per incident has increased sharply, from around $270,000 in early 2025 to about $2.39 million in early 2026, showing that attackers are aiming for higher value targets. This sits alongside broader expectations that total crypto hack and theft values will likely exceed $1.2 billion in 2026, as highlighted in CertiKs July 22 report.

2. Geography, Tactics And Victim Profile

CertiKs analysis and a separate Bloomberg summary both highlight Europe, and France in particular, as the current hotspot, with France accounting for 33 of 39 European cases. Tactics have escalated from isolated incidents to more systematic home invasions, which rose from 1 to 20 year over year, alongside increases in kidnappings, repeated torture reports and isolated murders tied to crypto extortion. These attacks target people rather than systems, using violence, intimidation or credible threats to force victims to unlock wallets, reveal seed phrases or authorize transfers, often after assailants have tracked them via public signals about wealth or crypto involvement. CertiK also notes that underreporting likely means the real numbers are higher.

3. Security, Custody And Market Impact

Despite the disturbing data, prediction markets still price a very high probability that Bitcoin will hold above key levels in the near term, suggesting that physical attacks are seen as concentrated rather than system-wide for major assets. However, the report underlines that security for serious holders now spans three layers: digital hygiene, operational controls and personal safety. Practical mitigations include separating public identities from large holdings, distributing control across multiple people or entities for high value wallets, improving home and travel security, and limiting mobile access to sensitive accounts. For markets, the main risk is confidence: a cluster of high profile physical extortion cases or failures by custodians to protect clients could shift sentiment rapidly, even if the direct capital loss is relatively small compared with overall market cap.

Conclusion

The surge in crypto wrench attacks shows that as capital in digital assets grows, criminals follow it into the physical world, targeting people rather than just code. For crypto users, this changes the security equation from protect my wallet to protect my whole setup and public footprint, while markets so far treat the problem as serious but contained. Watching how law enforcement responds, how custody providers harden processes and whether attacks remain localized will be key to understanding whether this remains a niche risk or becomes a broader drag on crypto adoption.