A report released by blockchain security company CertiK states that 52 "wrench attacks" targeting cryptocurrency holders were verified globally in the first half of 2026. These cases typically involve attackers using violence or threats to force victims to hand over their cryptocurrency assets. The related financial risks recorded during the same period rose to $124.1 million, significantly higher than the $10.5 million recorded in the first half of 2025.
Home intrusion has increased significantly.
The report shows that the number of such cases has increased by about one-third compared to 39 cases in the same period last year, and the average amount involved in a single case has also risen from $270,000 to $2.39 million. CertiK cautions that this figure includes not only the confirmed amount stolen, but also ransom demands, frozen assets, and subsequent recoveries, and therefore is closer to "financial risk exposure."
A more noticeable change is in the modus operandi. In the first half of 2025, there was only one publicly known home invasion, but this number increased to 20 in the first half of 2026, accounting for approximately 41% of all incidents. Kidnapping cases rose from 12 to 16. There was one fatal case in each of the two statistical periods.
France becomes a high-incidence area
In terms of regional distribution, Europe accounts for 75% of the verified cases. Among them, France alone has 33 cases, accounting for about 64% of the global total. CertiK believes that the active crypto industry in France, the higher concentration of practitioners and cryptocurrency holders, coupled with multiple data breaches, provides attackers with a more direct list of targets.
The report notes that the attack chain is becoming more specialized. Organizers are responsible for purchasing data, arranging routes, and coordinating execution, while the perpetrators are often recruited through messaging apps and are typically young. Attack groups piece together leaked databases, transaction records, and on-chain activity into "target profiles" and then use these profiles to select victims.
Safety recommendations shift towards personal protection
CertiK argues that the rise in such cases indicates that traditional digital asset custody methods are insufficient to cover all risks. Hardware wallets or hidden mnemonic phrases do not provide adequate protection when holders are subjected to face-to-face coercion. The report therefore recommends multi-signature verification, withdrawal delays, and emergency response plans for family members.
These cases have triggered broader law enforcement action in France. Reports indicate that by April of this year, French prosecutors had indicted 88 suspects in 12 investigations, more than 10 of whom were minors. French government officials have also stated that measures will be taken to strengthen protections for those working in and holding cryptocurrency tokens.
Additional information:According to previous statistics from CertiK, a total of 72 similar cases were recorded in 2025, an increase of 75% compared to 2024. One of the most high-profile cases was the kidnapping of Ledger co-founder David Balland and his wife in France in January of this year, which was subsequently rescued by the police.
