Blockchain security firm CertiK released a report on Wednesday detailing a sharp rise in physical attacks against cryptocurrency holders in the first half of 2026. The number of confirmed incidents reached 52, a 33.3% increase from the 39 cases recorded in H1 2025. The total financial exposure surged by over 1,000% year-over-year, climbing from $10.5 million to approximately $124.1 million. This figure includes ransom demands, stolen funds, and assets later frozen by authorities.
CertiK defines a wrench attack as any form of violence, intimidation, or credible threat used to force someone to transfer digital assets, provide private keys, or unlock a wallet. The tactic is described as an established threat vector that targets the person rather than the software, bypassing even the strongest digital security.
The attacks were heavily concentrated in Europe, which accounted for 39 of the 52 incidents. France emerged as the primary epicenter with 33 cases. Criminal methods also shifted significantly: the number of crypto-related home invasions jumped from a single publicly reported case in H1 2025 to 20 in H1 2026. Kidnappings rose from 12 to 16 during the same period. There were four cases of torture in both halves, and each half recorded one murder tied to a crypto coercion event.
The average recorded exposure per incident climbed from roughly $270,000 to $2.39 million. However, CertiK cautions that its totals likely understate the true scope because many victims do not report attacks due to fear, tax concerns, or reputational damage. The surge was most pronounced in Q1 2026 (35 incidents compared to 22 in Q1 2025), but Q2 2026 saw only 17 incidents, matching the Q2 2025 figure. Possible reasons for the decline include improved holder security, reporting delays, and law enforcement pressure.
To mitigate risks, CertiK recommends breaking the link between public identity and crypto holdings, storing significant assets under schemes where no single person can unilaterally transfer them, keeping wallets and signing tools separate, strengthening home security, and avoiding sensitive accounts on devices taken while traveling.
