Crypto ‘Wrench Attacks’ Explode: $124M Stolen in Six Months as Criminals Target Holders at Home
Violent robberies aimed at cryptocurrency owners are no longer rare outliers. They are becoming a disturbingly regular feature of the digital asset landscape, with attackers shifting from online exploits to physical threats in the real world. A new analysis from blockchain security firm CertiK shows that so‑called “wrench attacks” have surged in both frequency and severity, with France emerging as a key hotspot.
In the first half of 2026, CertiK confirmed 52 separate wrench attacks worldwide-cases where victims are coerced, often at knifepoint or gunpoint, into handing over their crypto. That figure represents a 33.3% increase from the 39 incidents recorded during the same period in 2025. Yet the truly alarming shift is financial: estimated exposure skyrocketed almost twelvefold, from $10.5 million in the first half of 2025 to $124.1 million in the first six months of 2026.
On a per‑case basis, the stakes have changed dramatically. The average recorded loss per incident jumped from roughly $270,000 to $2.39 million in a year. This suggests attackers are no longer opportunistically targeting small retail holders; they are identifying and going after high‑net‑worth individuals with significant on‑chain footprints and large balances on hardware wallets or self‑custody solutions.
The term “wrench attack” comes from a dark joke in cybersecurity: why bother spending months cracking encryption when you can simply threaten someone with a wrench until they give up their password? In crypto, this has become painfully literal. Victims are ambushed in their homes, pressured to unlock wallets, sign transactions, or reveal seed phrases while under duress. Unlike online hacks, these crimes weaponize fear, violence, and time pressure.
According to CertiK’s report, home invasions have become the primary attack vector. Instead of focusing on street muggings or abductions in public spaces, organized groups are increasingly breaking into residences, where they assume victims are relaxed, off guard, and have easy access to devices and backups. The home-long promoted as the safest place to store hardware wallets and recovery phrases-is now the main battleground in this new phase of crypto crime.
France stands out in the data as a particularly affected jurisdiction. While the report does not attribute a single cause, several factors likely intersect: a high concentration of affluent crypto holders, growing mainstream adoption of digital assets, and organized criminal networks that have learned to trace public blockchain activity and match it with real‑world identities. In several documented cases, victims were reportedly targeted after flaunting wealth, discussing holdings too openly, or reusing identifiable handles and profiles across platforms.
This shift from purely digital exploits to physical coercion has deeper implications for what “security” means in crypto. Traditionally, the conversation centered on smart contract bugs, exchange hacks, and phishing links. Wrench attacks bypass those defenses entirely. Even the most sophisticated cold storage setup is useless if the owner is forced, under threat of violence, to sign a transaction or recite a seed phrase. In other words, technical security alone is no longer sufficient; operational and personal security are now just as critical.
The rising average haul per attack suggests that criminals are doing more homework before striking. Many are likely using on‑chain analytics to identify addresses with large balances, then cross‑referencing that with social media, public appearances, or leaked data to uncover who controls those funds. Once a high‑value target is identified, home addresses can sometimes be discovered through public records, delivery histories, or careless digital footprints.
For individuals actively involved in crypto, this trend demands a change in behavior. One key principle is “wealth minimization in appearance”: avoid publicly signaling large holdings, especially under real names or easily traceable usernames. Sharing screenshots of seven‑figure portfolios, discussing exact wallet sizes in public forums, or boasting about major wins can all make someone a prime candidate for real‑world targeting.
Another critical measure is compartmentalization of funds. Storing the bulk of holdings in wallets that you genuinely cannot access quickly-because keys are geographically separated, distributed among multiple people, or locked behind multi‑signature schemes you alone cannot control-can reduce the amount an attacker can realistically force you to send. If an assailant demands access to “all” your funds but you only have limited balances on any device in your home, the potential damage shrinks dramatically.
Home security itself now has a direct financial component for crypto holders. Physical safeguards such as reinforced doors, visible alarm systems, surveillance cameras, and monitored security services can act as deterrents. Less obvious but equally important are behavioral protocols: not letting unknown individuals into your building, being cautious about delivery scams that bring strangers to your door, and avoiding predictable routines that make planning an attack easier.
Psychological preparation also matters. In a genuine life‑threatening scenario, personal safety is more important than funds. Yet having pre‑planned strategies-such as a “decoy wallet” with a plausible but smaller amount of crypto-may help defuse some situations. However, any such strategy must be weighed carefully; if an attacker senses deception, the risk of escalation increases. The goal is not to “win” against an assailant but to minimize harm to people first and assets second.
Multisignature wallets and shared custody arrangements can add an extra layer of protection. If significant funds require approvals from multiple signers in different locations, no single individual can unilaterally release all assets under duress. This structure, however, must be implemented thoughtfully. The existence of other keyholders could be unknown to attackers, but also may put additional people at risk if discovered.
The rise of wrench attacks is also a challenge for regulators and law enforcement. Traditional financial crime frameworks were built around bank fraud, card skimming, and money laundering via fiat instruments. Violent theft of crypto at home sits at the intersection of cybercrime and armed robbery, requiring coordination between digital forensics teams and local police forces. Successful responses will likely hinge on better training, international cooperation, and the use of blockchain tracing to follow stolen funds in real time.
Importantly, the data from CertiK likely understates the true scale of the problem. Many victims are reluctant to report incidents, fearing stigma, legal scrutiny of undeclared holdings, or retaliation from attackers. Others may assume that because crypto transactions are irreversible, law enforcement can do little to help. As a result, the official numbers-52 verified attacks and $124.1 million in recorded exposure in just six months-may only represent the visible portion of a much larger pattern.
For the broader crypto ecosystem, the escalation of physical attacks is a warning sign. As digital assets become more mainstream and more valuable, they start to resemble traditional forms of portable wealth like cash, gold, or jewelry-only with the added twist that ownership often ties back to a single individual with a memorized phrase or a device in their pocket. This combination of high value, bearer‑like characteristics, and public on‑chain visibility creates powerful incentives for targeted crime.
The path forward will require a cultural shift among crypto users. Opsec-operational security-needs to expand beyond private keys and phishing links to include personal privacy, physical safety, and threat modeling in the offline world. That means controlling what you reveal about your holdings, designing wallet setups that are resilient under duress, and treating your home environment as part of your security perimeter, not an afterthought.
Ultimately, the rise of wrench attacks underscores a fundamental truth: cryptography can protect data, but it cannot protect people. As violent, real‑world incidents grow in frequency and scale, anyone holding meaningful amounts of crypto must think not only like an investor or a trader, but also like a potential target-and take steps, now, to make themselves a far harder one.