Losses from crypto wrench attacks hit $101 million in the first four months of 2026. That is nearly double the $52.2 million recorded across the whole of 2025. Europe accounted for 82% of crypto wrench attacks this year, according to Web3 security company CertiK.
France alone recorded 24 incidents. The rest of the continent took the remainder. CertiK described the shift as a European hyperconcentration.
The Shift in Crypto Wrench Attacks
The frequency of crypto wrench attacks has increased sharply since 2025. The term refers to physical coercion used to extract private keys or seed phrases. Home invasions, kidnappings, extortion. CertiK documented 34 crypto wrench attacks globally since January. If the rate holds, the firm expects 130 incidents by December and losses running into several hundred million dollars.
The geographic tilt accelerated through 2025. Asia and North America saw fewer cases. Europe, and France in particular, became the centre. France’s National Prosecutor’s Office for Organized Crime reported 47 incidents in 2026, higher than CertiK’s count, which tracks only verified cases with open-source confirmation.
| Metric | 2026 (Jan-Apr) | 2025 (Full Year) | Change |
|---|---|---|---|
| Total Losses | $101 million | $52.2 million | +93% |
| Documented Attacks | 34 | Data not disclosed | — |
| Europe Share | 82% | Lower (trend emerging) | Sharp rise |
| France Attacks | 24 | Data not disclosed | — |
Why France
France emerged as a hot spot for several reasons. The presence of executives from Ledger, Paymium, and Binance made the country a known hub. Data leaks compounded the risk. Crypto accounting firm Waltio suffered a breach in January. A French tax official, Ghalia C, is accused of selling holder data to criminal networks.
CertiK also pointed to what it called a culture of voluntary doxxing and wealth signalling within the French crypto community. The firm noted that early 2026 marks a shift to data-driven targeting. Prior physical surveillance is no longer necessary once attackers have a victim’s full name, home address, and financial profile.
Blockchain intelligence firm TRM Labs reported in May last year that the rise in these attacks stems from the perceived pseudonymity of crypto transactions, the public visibility of wealth, and the ease with which personal data can be gathered online.
The Criminal Model
The orchestrators are typically located outside the target country. The on-the-ground teams consist of three to five people. They pose as delivery drivers or police officers, or they lure victims into ambushes with fictitious business meetings. CertiK said most are recruited via messaging apps such as Telegram or Snapchat for a few thousand dollars. They don’t know each other. They are complete amateurs.
Casa chief security officer Jameson Lopp has recorded 31 crypto wrench attacks so far this year. In March, he reported that four cases he was tracking turned out to be mistaken identity. The thieves attacked the wrong targets.
In April, at least 88 people were indicted in connection with alleged attacks on crypto owners in France. Ten of those indicted were minors. CertiK noted that the growing proportion of minors signals an increasing externalisation of criminal liability toward profiles less exposed to mandatory minimum sentences.
The Read
The structural takeaway on crypto wrench attacks is blunt. As protocol security and wallet architecture improve, the threat migrates to the human link. As long as crypto holdings remain associated with identifiable financial data, physical coercion will remain the economically most rational attack path for criminals who lack technical sophistication.
The rate of increase suggests the problem is accelerating, not stabilising. Next data point: whether the predicted 130 incidents materialise by year-end.
This article is for information purposes only and does not constitute investment advice. Readers should not act on any information contained here without first consulting an authorised financial adviser. Past performance is not a reliable indicator of future results.
