Wrench Attacks on Crypto Holders Surge to $124M in Six Months
In brief
- CertiK verified 52 wrench attacks in H1 2026, up 33% YoY, with average losses rising from $270K to $2.39M per incident.
- Home invasions surged from 1 to 20 cases, now representing 41% of all wrench attack incidents globally.
- France reported 33 wrench attacks—64% of global total—linked to visible crypto adoption and data breaches.
- Attackers use professional models: buying data and recruiting operators via messaging apps.
- CertiK recommends multi-signature wallets, withdrawal delays, and family duress protocols as defenses.
Home Invasions Drive Escalation
The defining shift in wrench attacks is a surge in home invasions. Home break-ins rose from a single publicly reported case in H1 2025 to 20 in H1 2026, now representing roughly 41% of all wrench attack incidents. The average recorded haul per incident more than doubled, climbing from $270,000 to $2.39 million between the two periods.
Kidnappings also intensified. Cases rose from 12 to 16 between H1 2025 and H1 2026, while one murder was recorded in each period. Attackers now target the entire security perimeter of a victim—their residence, family, and psychological resilience under duress.
France at the Epicenter
Europe accounted for 75% of verified wrench attack incidents in H1 2026. Within Europe, France dominates. The country alone accounted for 33 wrench attacks, representing roughly 64% of the global total.
CertiK links France's prominence to its large, visible crypto scene and a run of data breaches, including the France Travail and ANTS incidents. High-profile victims have included Ledger co-founder David Balland and his wife, kidnapped in January 2025, and the wife of The Sandbox co-founder Sébastien Borget, targeted in an attempted abduction outside Paris. By April 2025, French prosecutors had charged 88 suspects across 12 investigations, with more than 10 of them minors.
Professionalization and Risk
"CertiK also described an increasingly professional, layered model, with organizers who buy data and coordinate logistics sitting above disposable, often young operators recruited on messaging apps." — CertiK
The attackers' operational model has matured. Crews assemble target packages from leaked databases, exchange records, and on-chain activity. This layering—with organizers insulated from street-level perpetrators—suggests an organized crime infrastructure that's becoming harder to disrupt.
CertiK cautioned that its figures capture ransom demands and frozen or recovered assets, not just confirmed stolen value. Under-reporting remains severe. The firm recommends multi-signature setups, withdrawal delays, and family duress protocols as security measures. None of these are foolproof against an attacker with access to your home and family.
