Jameson Lopp maps 360 physical attacks on Bitcoin holders worldwide
In brief
- Dashboard visualizes 360 documented physical attacks on Bitcoin holders globally, filterable by geography, timeline, and severity.
- Attack frequency accelerated to 23 incidents in first 11 weeks of 2026; 2025 averaged over one per week.
- France identified as hotspot; fatal Mexico attack in September 2026 underscores growing threat severity.
- Community-curated dataset spans since 2014; actual incident count likely far higher due to underreporting.
- Multi-signature and time-locked transactions mitigate risk of forced asset access under duress.
The Data Behind the Dashboard
The dashboard visualizes attack locations, timelines, severity ratings, and other attributes, allowing users to filter by geography, time period, and attack severity. Lopp has maintained a community-curated GitHub repository cataloging physical attacks since at least 2014. The underlying dataset now contains 360 documented incidents, but the actual number is almost certainly higher, since many victims never report incidents publicly.
Early 2026 shows no sign of slowing. The first 11 weeks saw 23 documented incidents, maintaining the grim pace of more than one per week. A separate analysis by Haseeb Qureshi examined 269 of these incidents and found that more than half were rated as "Serious." A fatal attack in Mexico in September 2026 underscores that the upper end of the severity spectrum is not theoretical.
France has emerged as a particular hotspot, with multiple cases reported in recent years. Geography alone doesn't explain the risk. What matters is that wrench attacks bypass traditional cybersecurity by targeting the person holding the keys, not the keys themselves.
Why This Matters
Lopp's role at Casa, which provides multi-signature custody solutions, gives him a professional stake in making people aware of physical risks. But the dashboard itself carries no commercial pitch. It's a public resource built on open data.
The project is designed to be community-maintained, with Lopp encouraging contributions from anyone aware of unreported incidents. Multi-signature setups, time-locked transactions, and distributed key management all serve to prevent access to full Bitcoin balance under duress. These aren't theoretical protections. They're becoming practical necessities.
Frequently asked questions
What is a wrench attack?
A wrench attack targets the person holding the keys rather than the keys themselves, bypassing traditional cybersecurity measures. An attacker uses physical coercion to force a victim to reveal private keys or access credentials.
How can Bitcoin holders protect against physical attacks?
Multi-signature setups, time-locked transactions, and distributed key management help prevent access to a full Bitcoin balance under duress. These mechanisms ensure that no single person can authorize a transaction alone.
Why is the actual number of attacks likely higher than 360?
Many victims of physical attacks never report incidents publicly, either due to shame, fear, or lack of awareness that the attack was documented elsewhere. The dashboard relies on crowdsourced data, so unreported cases remain invisible.
