Physical attacks targeting cryptocurrency holders escalated sharply during the first half of 2026, with home invasions becoming the most commonly reported form of crypto-related “wrench attacks,” according to blockchain security firm CertiK.
CertiK recorded 20 publicly reported crypto home invasions in H1 2026, compared with just one during the same period a year earlier. The dramatic increase suggests criminals are increasingly targeting the human side of crypto security, using physical threats and coercion to bypass passwords, hardware wallets, and other digital protections.
Overall, CertiK verified 52 wrench attacks worldwide during the first six months of 2026, a 33.3% increase from 39 incidents in the comparable period of 2025.
Kidnappings also increased from 12 to 16 incidents, while reported robberies declined from five to one.
Financial exposure jumps to $124 Million
The financial exposure associated with these incidents rose dramatically.
CertiK estimated approximately $124.1 million was linked to verified attacks in H1 2026, compared with roughly $10.5 million a year earlier.
However, that figure should not be interpreted entirely as successfully stolen crypto. It can include ransom demands, assets transferred by victims, recovered or frozen funds, and even ransom demands that were ultimately unsuccessful.
The broader trend nevertheless highlights a changing security challenge for wealthy crypto holders, founders, traders, and industry executives.
Traditional cybersecurity focuses heavily on protecting private keys and accounts from remote attackers. Physical coercion changes that threat model entirely.
Even highly secure self-custody systems can become vulnerable if criminals can force an individual to unlock a wallet or authorize a transaction.
France emerges as the global center of crypto wrench attacks
France represented an unusually large share of the incidents tracked by CertiK.
Europe accounted for 39 of the 52 verified global attacks, while France alone accounted for 33, representing nearly two-thirds of CertiK’s worldwide total.
French government figures indicate the problem may be even broader.
French Interior Minister Laurent Nuñez said authorities recorded 77 crypto-linked kidnappings, extortion incidents, or attempted extortion cases during the first half of 2026, compared with 45 throughout all of 2025.
The difference between the figures reflects methodology. CertiK uses a narrower dataset limited to publicly reported incidents it can independently verify, while government statistics can include a broader range of cases.
One possible factor behind France’s concentration of attacks is the visibility of its crypto ecosystem.
CertiK noted that leaked personal information and data connecting individuals’ identities and home addresses with perceived cryptocurrency wealth could increase physical security risks.
French authorities step up their response
French authorities have introduced new measures aimed at protecting crypto entrepreneurs, investors, and professionals from physical attacks.
These include a dedicated prevention platform and rapid-alert mechanisms intended to improve communication and response when crypto-related threats emerge.
According to Nuñez, emergency measures introduced in response to the growing threat have contributed to approximately 200 arrests.
The rise in incidents demonstrates that crypto security is increasingly becoming a physical security issue as well as a cybersecurity problem.
Self custody security may need to evolve
The increase in wrench attacks also challenges a basic assumption surrounding cryptocurrency self-custody: that controlling your own private keys automatically provides maximum security.
Cryptographic protection can prevent unauthorized digital access, but it cannot by itself prevent someone from being physically forced to authorize a transaction.
CertiK recommends security structures that reduce the ability of any single person to immediately move an entire portfolio.
These can include multisignature or multiparty computation arrangements, withdrawal delays, transaction limits, and geographically separated signers.
Such systems can create structural barriers that remain effective even when one individual is compromised or coerced.
The surge in home invasions highlights an evolving reality for crypto security. As digital defenses become stronger and cryptocurrency wealth becomes more visible, some criminals may increasingly shift from hacking wallets to targeting the people who control them.
For high-value crypto holders, protecting digital assets may therefore require more than secure private keys. The next generation of self-custody security will increasingly need to account for both cyber threats and real-world physical risks.
