More than $30 million was stolen in violent cryptocurrency attacks during the first half of 2026, according to data from Chainalysis, which documented 46 such incidents globally through late June 2026. claim:1, claim:2

In security circles, these violent incidents—which include home invasions, kidnappings, and hostage situations targeting crypto holders—are referred to as 'wrench attacks.' claim:3

26%

The success rate of wrench attacks for attackers, down from 49% in 2025.

While the number of incidents remains high, the success rate for attackers has dropped to 26% in the first half of 2026, with only 12 of the 46 documented attacks resulting in payment. claim:20, claim:21

France as an epicenter

France has become a major center for these attacks, recording 30 incidents through mid-2026, more than any other country. claim:9

The surge in France is linked to an alleged breach involving tax records that exposed information regarding high-net-worth cryptocurrency holders. claim:10, claim:28

A French tax official allegedly accessed and sold information about crypto investors to criminals. claim:29

Additionally, a separate breach at the crypto tax-reporting company Waltio reportedly exposed data belonging to approximately 50,000 users. claim:30

French authorities have counted more than 70 wrench attack incidents, suggesting the actual total may be higher than the 30 publicly known cases. claim:25

In response to the increase, the French government has introduced a rapid-alert and protection system and promised improved intelligence-sharing and coordination with the cryptocurrency industry. claim:27

Criminal tactics and profiles

Criminals target cryptocurrency holders because they possess wealth in a form that is instantly and irreversibly transferable. claim:4

Home invasions, which now account for 37% of documented incidents compared to 26% in 2023, allow criminals to confront victims in a controlled environment to compel fund transfers. claim:5, claim:7

Attackers are increasingly targeting relatives and acquaintances to pressure victims. claim:6

Criminals often select victims through social media, data leaks, or insider information, employing tradecraft that is described as amateur regarding the violence but professional in other aspects. claim:23

The sophistication of attackers varies; while some have only a basic understanding and move funds directly to centralized exchanges, mid-tier attackers use decentralized exchanges, bridges, and DeFi tools to move assets while attempting to avoid the compliance programs of centralized exchanges. claim:11, claim:12, claim:13

Known cases likely understate the scale of the problem as many attacks go unreported. claim:22

In April, French authorities charged 88 suspects, including more than 10 minors, across 12 investigations involving organized gangs. claim:15

In June, a man was indicted in France for allegedly posing as a police officer during a wrench attack. claim:16

In July, CertiK said financial exposure from wrench attacks reached $124 million in the first half of 2026. claim:17