CertiK's report for the first half of 2026 shows that "wrench attacks" targeting crypto asset holders continue to increase. The agency recorded 52 verified cases, a 33.3% increase from 39 cases in the same period last year. The risk exposure associated with these cases reached $124.1 million, significantly higher than the approximately $10.5 million a year ago.
The amount here refers not only to confirmed stolen funds, but also includes ransom demands, frozen assets, and other amounts related to the case. CertiK stated that this figure reflects the recorded risk exposure, not the total amount the criminals ultimately obtained.
France accounts for the majority of the world
In terms of geographical distribution, Europe has the highest concentration of these cases. Of the 52 cases, 39 are in Europe, accounting for approximately 75% of the global total. France alone accounts for 33 cases, representing 63.5% of the verified cases worldwide. The United States recorded 4 cases, while Sweden and the United Kingdom each recorded 2.
CertiK also mentioned that the actual number of cases in France may be higher than the publicly verified figures. The French National Judiciary Police recorded 41 related incidents between January and March. Some of these cases are categorized in public records as robbery, kidnapping, assault, or extortion, and may not be explicitly labeled as related to crypto assets.
France has recently strengthened its response. Reports indicate that as of the end of April, prosecutors had charged 88 suspects in 12 investigations. With the increase in kidnappings and burglaries, the country is also preparing more preventative measures for cryptocurrency holders.
Home invasion crime rises to the top of the list
In terms of modus operandi, burglaries saw the most significant increase. CertiK recorded 20 burglaries in the first half of this year, compared to only one in the same period last year. This type accounted for approximately 41% of all cases in the first half of the year, making it the most common method.
During the same period, kidnapping cases increased from 12 to 16; torture cases remained at 4, and murder cases numbered 1. A so-called "wrench attack" typically refers to an attacker using violence, threats, or intimidation to force a victim to transfer crypto assets, hand over private keys, or unlock their wallet. Because the target is directly the person controlling the assets, this type of attack often bypasses on-chain and software-level security protections.
Recent cases have also affected the families and associates of cryptocurrency holders. The report mentions that the wife of Sébastien Borget, co-founder of The Sandbox, was the victim of an attempted kidnapping in France. Other cases show attackers posing as delivery personnel to approach victims.
Offline risks drive up security spending
As threats extend from online to offline, some crypto companies are increasing their executive security budgets. The report mentions that Coinbase will spend approximately $8.7 million on security and protection for CEO Brian Armstrong in 2025; Gemini has agreed to pay $400,000 per month for executive protection services.
MARA also disclosed that security spending related to CEO Fred Thiel amounted to $4.3 million, of which $430,000 was spent on vehicle protection modifications. This type of spending is rising as wealth information and personal data of executives, investors, and founders become more readily available online.
CertiK stated that the first quarter of this year saw the most significant increase in cases, with 35 cases recorded, up from 22 in the same period last year; the second quarter saw a decrease to 17 cases, on par with the same period last year. The agency also cautioned that the full-year data cannot be simply extrapolated from the first half's pace, but the known amounts involved in these cases are still significantly higher than last year.
