Crypto physical attacks exposed $124.1 million in six months, CertiK says
CertiK says verified “wrench attacks” rose to 52 in the first half of 2026, with Europe and especially France accounting for most cases.
By Theo Nakamura · Staff Writer
· 3 min read
Crypto crime is moving off screens and into people’s homes, according to blockchain security firm CertiK. For everyday investors, the report is a reminder that wallet security now includes personal data exposure, not just passwords and seed phrases.
CertiK said it verified 52 so-called wrench attacks worldwide in the first half of 2026, up from 39 in the same period a year earlier. A wrench attack means criminals use physical force, threats, kidnapping or home invasion to pressure someone into handing over crypto assets.
The financial exposure tied to those cases climbed to $124.1 million in the first six months of 2026, compared with $10.5 million in the first half of 2025, according to CertiK. The firm said the average recorded amount per incident rose to $2.39 million from $270,000.
CertiK cautioned that those figures do not equal confirmed stolen funds. The firm said its exposure tally includes ransom demands and assets that were frozen or recovered, and it warned that many incidents may go unreported because victims fear retaliation or damage to their reputation.
Home invasions became a major attack method
The biggest change in CertiK’s data was the rise in home invasions. The firm said publicly reported break-ins increased to 20 in the first half of 2026 from one in the same period of 2025, making up about 41% of verified cases.
CertiK described that shift as attackers targeting more than a person’s wallet setup. In the firm’s view, criminals are pressuring the victim’s home, family and ability to think clearly while under threat.
Kidnappings also increased, rising to 16 cases from 12 a year earlier, according to CertiK. The firm recorded one murder in each of the two six-month periods.
Europe, and France, dominated the case count
CertiK said Europe accounted for 75% of verified wrench attacks in the first half of 2026. France alone represented 33 of the 52 cases, or roughly 64% of the global total.
The firm linked France’s concentration of incidents to the country’s visible crypto community and to data breaches that may have helped criminals identify targets. CertiK pointed to breaches involving France Travail and ANTS as examples of incidents that could provide attackers with useful personal information.
The report also described a more organized model behind some attacks. CertiK said higher-level organizers buy data and coordinate logistics, while lower-level operators, often young people recruited through messaging apps, carry out the physical crimes.
According to CertiK, crews are building “target packages” using leaked databases, exchange records and on-chain activity. On-chain activity means transaction data that is visible on public blockchains, which can sometimes be tied to people when combined with other information.
That connection between digital records and physical risk is the core warning in the report. CertiK argued that limiting unnecessary data exposure is no longer only a privacy issue for crypto users, but also a personal-safety concern.
This story draws on original reporting from Decrypt.
