Crypto-related “wrench attacks” continued through the first half of 2026, with 52 verified incidents worldwide and $124.1 million in recorded financial exposure, according to CertiK.
Summary
- CertiK recorded 52 wrench attacks in H1 2026, with financial exposure reaching $124.1 million worldwide.
- France accounted for 33 verified incidents as Europe became main center of physical crypto attacks.
- Home invasions rose from one to 20 cases, becoming the most common attack type recorded.
The total includes stolen funds, ransom demands, frozen assets and other values tied to documented cases, rather than only money confirmed as lost.
The number of attacks rose 33.3% from 39 cases in H1 2025. Recorded financial exposure rose much faster from about $10.5 million a year earlier. CertiK calculated a 1,079% increase, while average exposure per incident climbed from roughly $270,000 to $2.39 million.
Meanwhile, the first quarter drove most of the increase in attack frequency. CertiK recorded 35 incidents in Q1 2026, compared with 22 during the same period last year. Activity then slowed to 17 verified attacks in the second quarter, matching the Q2 2025 total.
CertiK cautioned that its financial figures are “indicative, not exhaustive.” Some victims do not report attacks, while public records may not show whether ransoms were paid, recovered or frozen. The company therefore treats the $124.1 million figure as recorded exposure rather than confirmed criminal proceeds.
The report also warned against simply doubling the first-half total to predict the full year. A repeat of the H1 pace would put 2026 near 100 verified incidents, but CertiK said the calculation is not a forecast because Q1 and Q2 showed different trends.
France accounts for most verified wrench attacks
Europe recorded 39 of the 52 verified attacks, or 75% of the global total. France alone accounted for 33 incidents in CertiK’s dataset, equal to 63.5% of all verified cases worldwide and 84.6% of Europe’s total. The U.S. recorded four incidents, while Sweden and the UK recorded two each.
The French total may be higher than CertiK’s verified public dataset. The report cited France’s National Directorate of Judicial Police as recording 41 incidents between January and March. CertiK said some cases can be classified as robbery, kidnapping, assault or extortion without a clear crypto label.
As crypto.news previously reported, France has stepped up its response. Prosecutors charged 88 suspects across 12 investigations by late April, while authorities also prepared prevention measures for crypto holders after a rise in kidnappings and home invasions.
Home invasions become the leading attack method
Home invasions showed the sharpest change. CertiK recorded 20 such incidents in H1 2026, up from one in the same period last year. The category accounted for about 41% of first-half attacks. Kidnappings increased from 12 to 16, while torture remained at four cases and murder at one.
Wrench attacks rely on physical force, threats or intimidation to make victims transfer crypto, reveal private keys or unlock wallets. This can bypass digital safeguards because an attacker targets the person controlling the assets rather than the wallet software itself.
Recent cases have also involved relatives and people close to crypto holders.The wife of The Sandbox co-founder Sébastien Borget was targeted in an attempted kidnapping in France. Other reports have described attackers using fake delivery workers to gain access to victims.
Security spending rises as threats move offline
The increase in physical attacks has pushed some crypto companies to spend more on executive protection. As previously reported by crypto.news, Coinbase spent about $8.7 million on security and protection costs linked to CEO Brian Armstrong in 2025, while Gemini agreed to pay $400,000 per month for executive protection services.
MARA also disclosed $4.3 million in security spending connected to CEO Fred Thiel, including $430,000 for vehicle armoring. These costs have grown as public executives, investors and founders face risks tied to visible crypto wealth and personal information available online.
CertiK advised holders to limit public information connecting their identity, location and routines to crypto ownership. It also recommended separating signing devices from recovery materials, using multi-party controls for large holdings and avoiding setups in which one person can instantly move all assets under pressure.
The firm also urged families to prepare emergency plans and advised high-risk users to keep sensitive accounts off devices used while traveling. For companies, it recommended tighter controls around employee and customer data, along with security reviews for executives, travel and public events.
The H1 report shows that attack frequency slowed after the first quarter, but the financial value connected to known cases remained far above last year’s level. France accounted for most verified cases, while home invasions became the most common attack method in CertiK’s dataset.
