Crypto Wrench Attacks Steal Over $30M in 2026: Chainalysis

Criminals stole more than $30 million through physical attacks on crypto holders in the first half of this year, putting the year on pace to surpass the record $58 million stolen in 2025.

In a Chainalysis report released Thursday, the blockchain analytics firm said that 46 violent crypto-related incidents had been documented globally through late June, up from 40 during the same period in 2025. The incidents include kidnappings, home invasions and hostage situations, collectively known as “wrench attacks.” 

The findings suggest wrench attacks are increasing, expanding the risks facing crypto holders beyond custody and asset management to their physical safety, homes and families.

According to the report, only 12 of the 46 attempts resulted in payment, giving attackers a 26% success rate, down from 49% in 2025. However, the report acknowledged that known cases likely understate the scale of the problem, as many attacks go unreported. 

Chainalysis said the “tradecraft tends to be amateur at the point of violence, but professional at both ends,” with victims often selected through data leaks, social media or insider information before low-skilled crews carry out the attacks.

Success rate of crypto wrench attacks by year. Source: Chainalysis

France remains wrench attack hotspot

According to Chainalysis, France recorded 30 publicly known incidents by midyear, compared with 19 throughout 2025. The report noted that French authorities have counted more than 70 incidents, indicating the actual total may be substantially higher.

Related: Spain arrests suspect in 2025 kidnapping of Ledger co-founder

In July, Interior Minister Laurent Nuñez put the first-half count at 77 kidnappings, extortions or attempted extortions, up from 45 in all of 2025. In response, the government has introduced a rapid-alert and protection system and promised greater intelligence-sharing and coordination with the crypto industry.

Chainalysis said in the Thursday report that the alleged misuse of French tax records was the likeliest driver of the surge. A French tax official allegedly accessed and sold information about crypto investors to criminals, while a separate breach at crypto tax-reporting company Waltio reportedly exposed data belonging to about 50,000 users.

Onchain activity also showed varying levels of sophistication. Some attackers sent stolen funds directly to centralized exchanges, while others used bridges, decentralized exchanges and laundering services. Chainalysis said the most advanced cases showed links to broader criminal networks.

Magazine: Do the Coldcard attacks mean all hardware wallets are now insecure?