Crypto Wrench Attacks: Chainalysis Tallies $30 Million in Losses This Year

Criminals have already stolen more than $30 million from crypto holders through physical violence in 2026. Chainalysis researchers counted 46 such incidents in the first half of the year alone, putting 2026 on track to become the worst year on record.

What are wrench attacks, and why is everyone talking about them again?

The term "wrench attack" entered the community about a decade ago as a joke. The idea is simple: stealing bitcoin doesn't require cracking a private key, just an ordinary wrench and a threat. Today it's no joke. On Thursday, Chainalysis published a report documenting 46 violent incidents against crypto holders worldwide through late June. That compares with 40 during the same period in 2025. Back in February, another analytics firm, CertiK, reported a similar trend, counting 72 attacks in 2025, a 75% jump from the year before.

The category includes kidnappings, home invasions and hostage situations. Victims tend to be holders of Bitcoin and other assets whose value is easy to estimate from public blockchain data or leaks at exchanges and service providers. The irony is that blockchain transparency, prized by the crypto community, is exactly what makes it easier for criminals to spot wealthy targets. Researchers admit the official count likely understates the problem, since many victims never report attacks to police out of fear of retaliation.

"Criminals have recognized that crypto holders are high-value targets because they possess wealth in an instantly and irreversibly transferrable form."

- Chainalysis report, August 6, 2026

How do the attackers operate?

Chainalysis describes a two-stage scheme. Organizers first pick a target based on leaked data, social media activity or insider tips about a person's wealth. Crews are then sent to physically force the victim into transferring funds. The report's authors put it this way: planning is done carefully in advance, while the crews on the ground often act clumsily and leave a trail of evidence.

The success rate of these attacks has dropped sharply. In 2026, only 12 of 46 attempts resulted in payment, a 26% success rate. A year earlier that figure stood at 49%. Victims are refusing to pay on the spot more often, and police response times have improved. Public awareness campaigns warning crypto holders about these risks appear to be playing a role too.

• Preparation: organizers buy or steal personal data about crypto holders well ahead of time.
• Crews on the ground are usually low-skilled and follow strict instructions from organizers.
• Home invasions now outpace kidnappings in frequency. They made up 26% of cases in 2023, and that share has climbed to 37%.
• Attackers increasingly pressure relatives and acquaintances rather than the asset holders themselves.

Why has France become the epicenter?

France recorded 30 publicly known incidents by midyear, according to the report. That's more than any other country, and nearly double the 19 counted for all of 2025. French police believe the real number tops 70 cases, since not every incident makes it into analytics firms' reports.

Interior Minister Laurent Nunez said in July that the country had seen 77 kidnappings and extortion attempts since the start of the year, compared with 45 for all of last year. In response, the government launched a rapid-alert system and pledged closer cooperation with the crypto industry to share data on suspicious schemes.

Researchers link the surge to a tax-data leak. A French tax official is suspected of selling information about wealthy crypto holders to criminals, while a separate breach at tax-reporting company Waltio exposed data belonging to roughly 50,000 users. Last year, France also saw the kidnapping of a co-founder of the Ledger wallet. That high-profile case pushed authorities to pledge stronger protection for crypto holders, and police have since opened dozens of new investigations into organized gangs.

Where does the stolen money go?

Laundering methods vary with the attackers' skill level. Some send stolen funds straight to centralized exchanges without any attempt to hide the trail, immediately landing under the watch of compliance teams and KYC checks. More experienced players rely on decentralized exchanges, cross-chain bridges and MEV bots to scatter funds across dozens of wallets and delay contact with regulated platforms.

Chainalysis notes that the most sophisticated cases show links to broader criminal networks rather than lone attackers. That makes investigations harder and lowers the odds of recovering stolen funds. In some cases, the trail disappears into mixers before the victim even manages to report the crime.

What should crypto holders do?

Protection now extends beyond private keys and cold wallets. Experts advise against publicly disclosing the size of your holdings, splitting custody across multiple wallets, and avoiding setups where a transfer can be forced through under pressure in minutes. Being careful about who you tell about your crypto holdings, and where, also matters, since leaked personal data is often the starting point for an attack. Some in the community also recommend multisig wallets and splitting large balances across several addresses, so no single forced transfer can drain everything at once. Because of the physical risks of self-custody, some large holders are deliberately moving part of their portfolio to regulated custodial services, even though that runs against the whole point of holding your own keys.

That advice also applies to Ukrainians who meet strangers in person to sell USDT for hryvnia cash. Pick verified exchangers with a solid rating, meet in public places, and avoid sharing deal details in advance.

At Kurslog, we see that cash deals remain popular among users, so we recommend checking an exchanger's rating before every meeting rather than relying on one-off tips from chat groups.