CertiK: Crypto wrench attack losses jump 12-fold to $124 million in H1 2026

The Crypto wrench attack landscape deteriorated sharply during the first half of 2026, with verified incidents and financial exposure rising significantly as criminals increasingly turned to physical violence instead of technical exploits to steal digital assets.

According to CertiK’s H1 2026 Wrench Attacks Report, released on July 23, researchers verified 52 Crypto wrench attack incidents worldwide between January and June, representing a 33.3% increase from the 39 cases recorded during the same period in 2025. More strikingly, recorded financial exposure surged from approximately $10.5 million to $124.1 million an increase of nearly 1,079%.

The blockchain security firm said the findings indicate that physical coercion against cryptocurrency holders has evolved from a niche threat into a growing security crisis, with Western Europe accounting for the overwhelming majority of reported incidents.

Crypto wrench attack incidents concentrate in Europe

The report found that Europe accounted for 39 of the 52 verified Crypto wrench attack incidents recorded during H1 2026, representing 75% of all publicly verified cases.

France alone recorded 33 incidents, making it the global epicenter of the phenomenon. CertiK noted that while its methodology counted only publicly verifiable incidents, French authorities have reported even higher figures.

“H1 2026 confirms that wrench attacks are no longer a fringe phenomenon or an edge-case risk for cryptocurrency holders.” — CertiK, H1 2026 Wrench Attacks Report

The report also highlighted comments from French authorities regarding the worsening situation.

“Authorities had recorded 77 crypto-related physical incidents during H1 2026, compared with 45 during H1 2025.” — Laurent Nuñez, French Interior Minister

Outside Europe, North America recorded five incidents, Asia six, South America one, while Africa recorded no verified cases during the reporting period. The Middle East registered one incident after recording none during H1 2025.

According to CertiK, Europe’s dominance may be linked to its large concentration of crypto businesses and investors, extensive regulatory records, high-profile data breaches, and stronger public reporting that makes incidents easier to verify.

Home invasions become the dominant Crypto wrench attack method

One of the report’s most significant findings was the rapid shift in criminal tactics.

Home invasions increased from just one publicly reported incident in H1 2025 to 20 during the first half of 2026, making them the leading Crypto wrench attack method. Kidnappings also rose from 12 to 16 incidents, while torture cases remained unchanged at four and one murder was confirmed during both reporting periods.

CertiK said the growing preference for home invasions demonstrates that attackers are bypassing sophisticated cybersecurity measures by targeting victims directly.

The report warned that conventional advice encouraging users to store cryptocurrencies in hardware wallets or offline cold storage is no longer sufficient when criminals can physically force victims to unlock wallets or reveal recovery phrases.

Among the most notable incidents was a March home invasion near Paris, where attackers allegedly forced a couple to transfer roughly €900,000 worth of Bitcoin.

 

Another case involved the kidnapping of a South Korean national in Malaysia, where kidnappers demanded 10 million USDT before authorities later recovered a significant portion of the ransom.

The report also referenced the “Sillytuna” case in the United Kingdom, where approximately $24 million in crypto assets were reportedly surrendered following physical assault.

Data leaks and insider access fuel targeting

CertiK said modern Crypto wrench attack operations increasingly rely on extensive intelligence gathering before any physical confrontation occurs.

Rather than identifying victims solely through public displays of wealth or conference appearances, attackers now combine leaked databases, compliance records, exchange information, social media profiles, blockchain activity, and other publicly available information to build detailed victim profiles.

The report also cited investigations suggesting insider access has become part of the criminal supply chain.

According to CertiK, French investigators have alleged that a tax administration employee sold confidential information relating to cryptocurrency investors, while Kraken previously disclosed an extortion attempt involving malicious insiders within its customer support environment.

The firm said these developments expand the threat beyond personal operational security, making organizations that store sensitive customer information an increasingly attractive target for criminals.

CertiK urges stronger operational security

Looking ahead, CertiK expects the Crypto wrench attack threat to remain elevated throughout the second half of 2026, although future trends will depend on law enforcement activity, criminal adaptation, and the visibility of cryptocurrency holders.

The report estimates that if the first-half pace continues, approximately 100 verified incidents could occur by year-end, although researchers stressed that this arithmetic projection should not be interpreted as a formal forecast.

“The objective here is to reduce targetability, make coercion less profitable, and ensure that one threatened human cannot unilaterally release catastrophic value.” — CertiK, H1 2026 Wrench Attacks Report

To reduce exposure, CertiK recommended minimizing public disclosure of crypto holdings, separating wallets by purpose, adopting multi-signature custody, implementing withdrawal delays, strengthening family security protocols, and reducing the amount of sensitive customer information retained by organizations.

The report concludes that the modern Crypto wrench attack is no longer solely a cybersecurity issue but a broader physical security challenge, where data exposure, personal privacy, and operational security increasingly determine who becomes a target.

Source: CertiK Intel3D H1 2026 Wrench Attacks