France launches three-part plan as crypto wrench attacks surge to 77 in H1 2026
In brief
- 77 crypto-linked kidnapping and extortion incidents hit France in H1 2026, up 71% from 45 in 2025
- Interior Minister Nuñez announced three-part plan: stronger intelligence-sharing and industry partnerships
- Emergency measures yielded 200 arrests; France averaged nearly three wrench attacks weekly in 2026
The Scale of the Problem
France averaged nearly three crypto wrench attacks per week in 2026. The incidents target a substantial population: approximately 11% of French people own cryptocurrencies, equating to about 7.3 million people. The targeting isn't random. Blockchain security firm CertiK identified France as the "epicenter" of attacks because of the presence of several flagship industry companies and a culture of flexing and voluntary doxxing, combined with exposure from data leaks.
The global trend reinforces France's vulnerability. CertiK reported that wrench attacks globally were up 41% in the first four months of 2026 compared with the same period last year, with most occurring in Europe. One high-profile case underscores the threat's severity: David Balland, co-founder of Ledger, was kidnapped and held for ransom along with his partner in January 2025 before being rescued by police. That incident followed Ledger's 2020 data breach, which resulted in the leak of more than 270,000 personal records.
Government Response and New Measures
Nuñez's announcement signals a shift toward more coordinated intervention. The three-part plan includes stronger intelligence-sharing, since criminal networks are often based abroad, a deeper partnership with ADAN (the French blockchain association), and better operational coordination between security services.
Earlier emergency measures have already shown some results. French authorities launched a dedicated prevention platform and a rapid-alert and protection system for crypto holders and professionals that attracted 724 sign-ups. Emergency measures have resulted in 200 arrests, with one recent attacker being arrested within eight hours on Friday using an emergency identification hotline.
The speed of that arrest illustrates what coordinated action can achieve. Still, with nearly three attacks per week, the infrastructure gap remains wide.


