Crypto Wrench Attacks on Pace for Record Year as $30M Stolen in 2026: Chainalysis

Physical attacks targeting cryptocurrency holders are on pace for their worst year on record, with more than $30 million stolen during the first half of 2026, according to a report by blockchain analytics firm Chainalysis.

In a new report published on Thursday, Chainalysis documented 46 violent crypto attacks through late June, estimating that victims lost more than $30 million in attacks.

“Violent attacks targeting crypto holders, including home invasions, kidnappings, and hostage situations, sometimes called ‘wrench attacks’ in security circles, have surged in recent years,” Chainalysis wrote. “Criminals have recognized that crypto holders are high-value targets because they possess wealth in an instantly and irreversibly transferrable form.”

A wrench attack refers to the use of threats or physical violence to force victims to hand over cryptocurrency.

While kidnappings remain the most common type of attack, home invasions have become more frequent, rising to 37% of documented incidents from 26% in 2023. Chainalysis also found attackers are increasingly targeting relatives and acquaintances to pressure victims into transferring crypto.

“Home invasions allow criminals to confront victims in a controlled environment where they can compel a transfer of funds,” Chainalysis wrote. “Kidnappings, by contrast, are much more difficult to execute. Attackers must expend considerable time and resources planning logistics; and the extended periods spent with victims leaves the attacker exposed for longer.”

France has become a major center of wrench attacks, recording 30 incidents through mid-2026, more than any other country. Chainalysis said the increase appears to be linked to an alleged breach involving tax records that exposed information about high-net-worth crypto holders.

The report also found wide differences in how attackers handle stolen funds. While some attackers appear to have only a basic understanding of cryptocurrency, moving stolen funds directly to centralized exchanges without attempting to hide their trail, others use far more sophisticated methods to obscure where the money goes.

“Mid-tier attackers demonstrate greater familiarity with crypto infrastructure. They may use decentralized exchanges, bridges, MEV bots, and other DeFi tools to swap and move assets across chains,” Chainalysis wrote. “They understand that centralized exchanges represent chokepoints with sophisticated compliance programs and user KYC, and attempt to avoid or delay interaction with them.”

The report comes as violent attacks against crypto holders continue to rise.

In February, CertiK reported wrench attacks climbed 75% in 2025 to a record 72 incidents, with France emerging as the epicenter. In April, French authorities charged 88 suspects, including more than 10 minors, across 12 investigations as they expanded their crackdown on organized gangs behind a wave of violent crypto wrench attacks.

In June, French authorities indicted a man accused of taking part in a crypto wrench attack after allegedly posing as a police officer. In July, CertiK said financial exposure from wrench attacks reached $124 million in the first half of 2026. This week, five men were convicted in London of imprisoning and torturing two French crypto millionaires in an extortion scheme.

Beyond the wave of wrench attacks in Europe, Bitcoin ransom demands have also made national headlines in the U.S. Earlier this year, ransom notes demanding Bitcoin surfaced during the investigation into the kidnapping of “Today” host Savannah Guthrie’s mother, Nancy Guthrie.