Crypto home invasions surge to 20 incidents in H1 2026: CertiK
In brief
- Home invasions rose to 20 incidents in H1 2026 from one year earlier, becoming the most common wrench attack type.
- CertiK verified 52 wrench attacks in H1 2026, up 33.3% from H1 2025, with $124.1 million in financial exposure.
- France accounted for 33 of 52 verified incidents, with authorities recording 77 crypto-linked kidnappings and extortion cases.
- Kidnappings increased to 16 from 12; robberies declined from five to one between the two periods.
- French authorities deployed prevention platform, rapid-alert system, and arrested 200 suspects.
Wrench attacks spike globally
CertiK verified 52 wrench attacks worldwide in the first half of 2026, up 33.3% from 39 incidents during the same period in 2025. Beyond home invasions, kidnappings rose to 16 from 12, while robberies declined from five incidents to one. Financial exposure linked to the attacks reached about $124.1 million, up sharply from $10.5 million a year earlier.
The data underscores a troubling reality for crypto holders. Digital security alone no longer suffices when attackers resort to physical force.
France bears disproportionate burden
France accounted for 33 of 52 verified wrench attacks, or nearly two-thirds of the global total. Europe overall recorded 39 of the 52 verified incidents. French Interior Minister Laurent Nuñez said authorities had recorded 77 crypto-linked kidnappings, extortion cases or attempted extortion cases during the first half of 2026, up from 45 in the entire year of 2025. The disparity between CertiK's count (33) and French authorities' figure (77) reflects methodological differences—CertiK used a narrower methodology, counting only publicly reported incidents it could independently verify.
Response and mitigation
French authorities launched a dedicated prevention platform and a rapid-alert system for crypto holders and professionals in response to the surge. Emergency measures have resulted in 200 arrests.
CertiK recommended multisignature or multiparty computation arrangements, withdrawal delays, spending limits and geographically separated signers to address physical coercion risks. These mechanisms distribute signing authority across multiple parties or locations, making it harder for attackers to extract funds even under duress.
