Physical Crypto Attacks Surge Toward Record Year
Violent attacks targeting cryptocurrency holders have already surpassed $30 million in stolen funds through the first half of 2026, putting the year on course to eclipse the record $58 million taken in all of 2025, according to a new report from blockchain analytics firm Chainalysis published Thursday [1].
The firm documented 46 incidents globally through late June — up from 40 during the same period last year — encompassing kidnappings, home invasions, and hostage situations, collectively referred to in security circles as "wrench attacks" [1]. The term describes the use of physical force or threats to compel victims to transfer cryptocurrency on the spot.
"Criminals have recognized that crypto holders are high-value targets because they possess wealth in an instantly and irreversibly transferrable form," Chainalysis wrote in the report [2].
Home Invasions on the Rise
While kidnappings remain the most common attack type, home invasions are growing as a share of incidents, rising to 37% of documented cases in 2026 from 26% in 2023 [2]. Chainalysis attributed this shift to the tactical advantages home invasions offer perpetrators.
"Home invasions allow criminals to confront victims in a controlled environment where they can compel a transfer of funds," the firm noted, adding that "kidnappings, by contrast, are much more difficult to execute" because of the extended planning required and the prolonged exposure they create for attackers [2].
Attackers are also increasingly broadening their targets beyond the primary crypto holder. Chainalysis found a growing pattern of criminals targeting relatives and acquaintances as leverage to pressure victims into transferring funds — a tactic that extends the threat landscape well beyond the individual [2].
Success Rates Falling, But Attacks Underreported
Despite the rising frequency of attacks, criminals are succeeding less often. Only 12 of the 46 documented attempts resulted in a payment, giving attackers a 26% success rate — down sharply from 49% during the same period in 2025 [1]. Improved awareness, security practices among holders, and law enforcement responses may be contributing factors, though Chainalysis cautioned that the true scale of the problem is almost certainly larger than the data reflects, as many incidents go unreported [1].
The firm also described a structural pattern in how attacks are organized: "tradecraft tends to be amateur at the point of violence, but professional at both ends," with victims identified through data leaks, social media monitoring, or insider information before lower-skilled crews carry out the physical confrontation [1].
France Emerges as Global Epicenter
France has become the most heavily affected country, recording 30 publicly known incidents through mid-2026 — more than any other nation [2]. That figure itself likely understates the problem: French Interior Minister Laurent Nuñez placed the first-half count at 77 kidnappings, extortions, or attempted extortions, up from 45 across all of 2025 [1].
Chainalysis identified the alleged misuse of French tax records as the most probable driver of the surge. A French tax official allegedly accessed and sold information about crypto investors to criminal networks, while a separate breach at crypto tax-reporting company Waltio reportedly exposed data on approximately 50,000 users [1].
French authorities have responded with significant enforcement action. In April, they charged 88 suspects — including more than 10 minors — across 12 investigations targeting organized gangs behind the attacks [2]. The government has also introduced a rapid-alert and protection system and pledged greater intelligence-sharing with the crypto industry [1].
The violence has extended beyond French borders. This week, five men were convicted in London for imprisoning and torturing two French crypto millionaires in an extortion scheme [2]. In June, French authorities indicted a man accused of participating in a wrench attack after allegedly posing as a police officer [2].
A Spectrum of Criminal Sophistication
One of the more striking findings in the Chainalysis report concerns how stolen funds are moved after an attack — and the wide variation in technical skill on display.
Some attackers show only a rudimentary grasp of cryptocurrency, transferring stolen assets directly to centralized exchanges without any attempt to obscure the trail [2]. Others operate at a considerably higher level.
"Mid-tier attackers demonstrate greater familiarity with crypto infrastructure. They may use decentralized exchanges, bridges, MEV bots, and other DeFi tools to swap and move assets across chains," Chainalysis wrote, noting that more sophisticated actors understand centralized exchanges as "chokepoints with sophisticated compliance programs" and work to avoid or delay interaction with them [2].
The most advanced cases documented in the report showed links to broader criminal networks, suggesting that at least some wrench attack operations are not opportunistic but are embedded within organized crime structures [1].
A Broader Threat Landscape
The Chainalysis findings arrive alongside other data points underscoring the severity of the trend. In July, security firm CertiK estimated total financial exposure from wrench attacks reached $124 million in the first half of 2026 alone — a figure that diverges from Chainalysis's $30 million estimate, likely reflecting different methodologies and definitions of "exposure" [2].
In the United States, the issue has surfaced in a different form: ransom notes demanding Bitcoin appeared during the investigation into the kidnapping of "Today" show host Savannah Guthrie's mother, Nancy Guthrie, earlier this year [2].
What to Watch
The second half of 2026 will determine whether the year definitively breaks the records set in 2025. Key indicators to monitor include whether France's new rapid-alert system and enforcement crackdowns produce a measurable reduction in incidents, how the alleged tax-record breach is prosecuted and whether similar data vulnerabilities are identified in other jurisdictions, and whether the declining success rate for attackers holds — or whether criminal networks adapt their tactics to improve their odds. The expanding targeting of family members and the growing sophistication of post-attack laundering suggest the threat is still evolving.