Violent, in-person attacks on cryptocurrency holders — often called "wrench attacks," after the webcomic that popularized the term for coercing crypto access through physical force rather than hacking — have produced $30 million in stolen funds through mid-2026 across 46 documented incidents globally, according to Chainalysis data.
Attackers attempted to extract roughly $107 million in total this year, meaning the majority of attempts failed to reach their target. That failure rate is itself the more striking trend: only 12 of 46 attempts succeeded in 2026, a 26% success rate, down sharply from 49% in 2025, when total losses reached a then-record $58 million.
France has become the epicenter
No country has seen the trend accelerate like France. Incidents there surged from nearly zero before 2025 to 19 recorded cases that year, then to roughly 4.6 incidents per month in early 2026 — more than double the 1.9-per-month pace seen in 2025. French authorities have documented more than 70 incidents in total and made close to 200 arrests, with 88 indictments and 75 suspects held in pretrial detention as of mid-2026. Interior Minister Laurent Nuñez announced enhanced security measures in late June in response.
How attackers are finding targets
Chainalysis traces much of the French surge to a 2024 data breach, in which a French tax official allegedly stole and sold dossiers containing names, addresses, crypto holdings, phone numbers, and tax records of high-net-worth crypto holders — giving attackers a ready-made target list rather than requiring them to identify wealthy holders independently.
Related: Active Bitcoin Addresses Hit 18-Month High as Coldcard Exploit Drives Mass Wallet Migration
The tactics have also evolved: home invasions now account for 37% of attacks, up from 26% in 2023, and kidnappings make up 52% of incidents. Family members are increasingly targeted too, appearing in 25% to 30% of cases by early 2026 versus almost none in 2021, with France alone seeing family members targeted in 40% of its incidents. Between 77% and 100% of victims across tracked incidents were local residents, suggesting attackers are conducting real reconnaissance rather than opportunistic targeting.
