Crypto Crime Turns Physical as Wrench Attacks Surge

Cryptocurrency theft is no longer confined to hacked wallets and exploited smart contracts. A new report from blockchain security firm CertiK shows that physical coercion against crypto holders — known in the industry as "wrench attacks" — produced roughly $124 million in losses during the first half of 2026, up nearly 12-fold from the same period a year earlier, even as the number of documented incidents rose a comparatively modest 33.3%.

Attackers Widen Their Net to Families

The report's most striking finding is the explosion in home invasions, which climbed from a single recorded case in the first half of 2025 to 20 cases in the same period this year, now accounting for 41% of all incidents tracked. That shift suggests criminals are moving away from opportunistic street robbery toward planned operations conducted inside victims' residences.

Perpetrators are also broadening their pool of leverage points, according to the findings. Rather than confronting asset holders directly, some groups are said to be threatening or controlling spouses, children, parents or employees to pressure a target into unlocking a wallet or approving a transfer.

Because relatives and staff often keep a lower public profile and follow predictable daily routines, they present a softer target than the crypto holder themselves. That dynamic is forcing a rethink of security models built around protecting a single individual rather than an entire household or business circle.

Europe, and France Specifically, Bear the Brunt

Geographically, the report identifies Europe as the epicentre of this violence, recording 39 of the 52 verified global cases — three-quarters of the total. France alone logged 33 incidents, or 63.5% of every case documented worldwide, making it by a wide margin the country most affected by wrench-style attacks in this period.

The United States recorded four cases, while the United Kingdom and Sweden each logged two, with the remainder scattered thinly across other regions. The concentration in a handful of European markets raises questions about whether local factors — wealth visibility, data protection gaps or law enforcement capacity — are making certain jurisdictions disproportionately attractive to organised crime networks.

The report also points to a changing method of target selection. Where criminals once relied on social media scraping or observing public events, they are now said to be sourcing precise victim profiles — names, addresses, estimated holdings and social connections — through dark web marketplaces, data brokers and, in some documented cases, insiders illegally selling customer data.

Why Physical Risk Is Becoming a Core Security Concern

The scale of this shift matters because it exposes a blind spot in an industry that has spent years hardening digital defences — multi-signature wallets, audited smart contracts, custody protocols — while giving comparatively little attention to the physical safety of the people who control those assets. As digital asset values and the population of wealthy holders grow, the incentive for criminals to bypass code entirely and go after a person directly becomes correspondingly stronger.

This mirrors a broader pattern across the security industry, where firms are increasingly treating human and operational vulnerabilities as seriously as technical ones; payments technology providers such as Paytia's approach to shielding card data reflects a similar recognition that fraud prevention now has to cover both systems and the people interacting with them.

To address the gap, CertiK has introduced an operational security service that evaluates the personal data exposure of executives and high-net-worth individuals, tests internal systems for penetration risk, and reviews compliance against frameworks such as VARA, DORA and MiCA. A separate analytics platform is designed to link off-chain intelligence with on-chain transaction flows and anti-money-laundering signals to help investigators trace and attribute criminal activity more quickly.

Taken together, the figures point to a maturing threat model in which criminal networks treat crypto theft as a logistics and intelligence problem rather than a purely technical one. With CertiK signalling closer cooperation with agencies including INTERPOL and Europol, the coming months are likely to test whether cross-border law enforcement coordination can keep pace with increasingly organised, data-driven extortion campaigns.