Chainalysis has reported that criminals stole over $30 million through physical attacks on cryptocurrency holders during the first half of 2026, putting this year on pace to exceed the record $58 million observed in all of 2025. The firm documented 46 violent incidents worldwide by late June, up from 40 in the same period last year.
The attacks, commonly known as “wrench attacks,” include kidnappings, home invasions, hostage situations, and forced transfers. Only 12 of these attempts succeeded in extorting funds, marking a 26% success rate – a sharp decline from 49% in 2025 and 67% in 2024. Nevertheless, the growing number of attempts is driving total losses toward a new annual peak.
France has become the primary hotspot, accounting for 30 publicly known incidents by midyear, up from 19 throughout all of 2025. Interior Minister Laurent Nuñez disclosed that authorities had recorded 77 kidnappings, extortions, or attempted extortions in the first half, a jump from 45 in the entire previous year. The violence has spread beyond Paris to cities like Marseille, Lyon, and Grenoble, and into smaller communities previously unaffected.
Chainalysis attributed the surge in part to compromised personal data. A French tax official was allegedly involved in selling records containing names, addresses, phone numbers, tax details, and estimated crypto holdings of investors. Additionally, a breach at crypto tax-reporting firm Waltio reportedly exposed data on roughly 50,000 users. Leaked financial records combined with home addresses likely gave criminals a ready-made list of targets.
Attackers are increasingly going after family members and acquaintances rather than the crypto holder directly. Relatives or close contacts were involved in 25–30% of global incidents by early 2026, up from almost none in 2021. In France, this figure surpassed 40%. Home invasions comprised 37% of incidents, up from 26% in 2023, while kidnappings were behind 53% of the funds lost. Most victims were local residents—93% in France, 82% in Brazil, and 77% in the United States—indicating prior surveillance rather than random attacks.
Once stolen, crypto assets exhibited varying levels of laundering sophistication. Some perpetrators directly sent funds to centralized exchanges without obfuscation, aiding recovery. Others employed decentralized exchanges, cross-chain bridges, and mixers to break the trail. In one case, stolen funds flowed through an instant exchange before reaching a suspected laundering service tied to cartel networks, terrorist-financing clusters, and wallets linked to a cocaine trafficker.
The declining success rate suggests that victims, exchanges, and law enforcement are becoming more effective at freezing or tracing stolen funds, though the sheer volume of attacks still pushes total losses higher. Chainalysis suspects that many incidents go unreported due to fear or privacy concerns, implying the actual problem is larger.
This trend adds a new dimension to crypto security, extending beyond private keys and cold wallets. Investors are urged to limit public exposure, protect personal data, and carefully consider who knows the extent of their holdings.
