The first half of 2026 saw a stark shift in crypto-related crime, with physical coercion incidents — especially home invasions — surging dramatically, according to CertiK’s Intel3D H1 2026 Wrench Attacks report. The blockchain security firm verified 52 wrench attacks worldwide, up from 39 a year earlier. Home invasions jumped from just 1 publicly recorded case in H1 2025 to 20 in the same period of 2026, making it one of the dataset’s dominant categories. Kidnappings also rose from 12 to 16.
The recorded financial exposure reached $124.1 million, a more than tenfold increase from $10.5 million. However, the report emphasizes that this total was heavily skewed by a few large incidents—most notably a March event where pseudonymous game developer Sillytuna was forced to transfer roughly $23.6 million in an Aave USDC position. That single case accounted for about 19% of the total, underscoring that the average is not representative of typical attacks. CertiK’s methodology includes only incidents verifiable through police statements, court documents, victim testimony, or on-chain evidence, so the true number of cases is likely higher.
France emerged as the most visible hotspot, accounting for 33 of the 39 European cases and 63% of all verified attacks globally. The Gendarmerie nationale reported 77 crypto-related kidnappings and unlawful confinement cases by early July, though CertiK’s stricter verification process yields a lower count. France’s high visibility may be amplified by better official tracking and reporting mechanisms, but its large, public crypto industry and accessible personal data could also make targets easier to identify.
An independent database maintained by Jameson Lopp, co‑founder of Casa, logged 46 physical attack entries in the first half of 2026, broadly aligning with CertiK’s findings. Both datasets confirm that such crimes are no longer isolated and are occurring repeatedly across multiple countries. The report stresses that perpetrators often build detailed target profiles using leaked identity information, social media, blockchain activity, and public appearances, showing that physical security is now a critical component of crypto safekeeping.
