USDCrypto Wrench Attacks Put 2026 on Record Pace
France emerges as the leading hotspot as criminals increasingly target homes and relatives
TL;DR
- Chainalysis documented 46 violent crypto attacks through late June, with confirmed thefts exceeding $30 million.
- France recorded the most publicly known incidents, while home invasions became a larger share of attacks.
- Criminals used tactics ranging from direct exchange deposits to cross-chain laundering through decentralized finance tools.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
Chainalysis said violent attacks against cryptocurrency holders were on pace for their worst year on record after criminals stole more than $30 million during the first half of 2026, amid a rise in home invasions, kidnappings and attacks involving victims’ relatives.
Chainalysis released its findings on Aug. 6, documenting 46 violent crypto attacks through late June. The firm defines such incidents, often called wrench attacks in security circles, as the use of threats or physical violence to force victims to transfer cryptocurrency, reveal wallet credentials or authorize transactions.
“Violent attacks targeting crypto holders, including home invasions, kidnappings, and hostage situations, sometimes called ‘wrench attacks’ in security circles, have surged in recent years,” Chainalysis wrote. “Criminals have recognized that crypto holders are high-value targets because they possess wealth in an instantly and irreversibly transferrable form.”
The first-half theft total placed the year on a trajectory that could surpass the $58 million stolen throughout 2025 if successful attacks continued at a similar pace. The confirmed-loss estimate covers cryptocurrency obtained by attackers rather than every attempted theft or the broader amount placed at risk.
France records the highest known attack count
France became the leading publicly documented center of crypto wrench attacks, recording 30 incidents through midyear, more than any other country. The country had recorded only a small number of such attacks before the recent surge, followed by 19 cases during the previous year.
The monthly pace increased from about 1.9 incidents during the earlier period to roughly 4.6 during the first six months of the current year. French Interior Minister Laurent Nuñez separately said authorities had documented 77 incidents and announced plans for a rapid-alert system intended to protect people considered particularly exposed.
Chainalysis linked part of the increase to an alleged breach involving French tax records. A tax official allegedly stole and sold dossiers containing crypto holders’ names, home addresses, telephone numbers and information about their holdings, creating a pool of personal and financial data that criminals could potentially use to identify targets.
Two developments during January may have contributed to the subsequent increase. French authorities publicly disclosed the tax-record investigation, while cryptocurrency tax-reporting company Waltio disclosed a separate breach involving approximately 50,000 users.
Eric Jardine, Head of Research at Chainalysis, said centralized collections of sensitive information remain attractive to criminals when the data can be exploited.
“Any time a central repository collects valuable, exploitable intelligence, illicit actors will seek to attempt a breach. This is especially true of sensitive information like tax records. Implementing strict information controls on targetable data is one useful way to mitigate the risks,” Jardine said.
The United States, Brazil and Thailand were also among the countries with the highest cumulative number of documented wrench attacks since 2023. Jardine said Thailand’s position may partly reflect its appeal to cryptocurrency users, expatriates and tourists.
“Thailand is a crypto-friendly jurisdiction that attracts a large expat and tourist population. Some of these newcomers may be bringing their crypto holdings with them. One unfortunate implication of this trend is a larger population of potential wrench attack victims,” Jardine said.
We’ve launched the all-new COIN360 Perp DEX, built for traders who move fast!
Trade 130+ assets with up to 100× leverage, enjoy instant order placement and low-slippage swaps, and earn USDC passive yield while climbing the leaderboard. Your trades deserve more than speed — they deserve mastery.
Attack success falls as home invasions rise
The proportion of attacks that successfully extracted cryptocurrency declined sharply even as the total number of incidents continued to increase.
The types of attacks also shifted. Kidnappings remained the largest category at 52%, while home invasions accounted for 37% of documented incidents. One comparison showed the home-invasion share rising from 14% a year earlier, while a separate historical comparison placed the share at 26% three years earlier. The figures use different baseline periods and describe the same broader move toward attacks inside victims’ residences.
Chainalysis said home invasions allow criminals to isolate victims in a setting where they can directly demand access to funds.
“Home invasions allow criminals to confront victims in a controlled environment where they can compel a transfer of funds,” Chainalysis wrote. “Kidnappings, by contrast, are much more difficult to execute. Attackers must expend considerable time and resources planning logistics; and the extended periods spent with victims leaves the attacker exposed for longer.”
Criminals also increasingly used relatives and acquaintances as leverage. People connected to the primary holder accounted for an estimated 25% to 30% of cases globally and more than 40% of cases in France. Attackers could threaten or assault family members to pressure the person controlling the wallet into complying.
Attackers show uneven laundering capabilities
Chainalysis found wide differences in how criminals handled stolen funds. Less sophisticated attackers sometimes transferred cryptocurrency directly to centralized exchanges without attempting to conceal the transaction trail, exposing themselves to compliance monitoring and know-your-customer records.
More capable groups used decentralized exchanges, blockchain bridges, maximal extractable value bots and other decentralized-finance tools to exchange assets and move them between networks.
“Mid-tier attackers demonstrate greater familiarity with crypto infrastructure. They may use decentralized exchanges, bridges, MEV bots, and other DeFi tools to swap and move assets across chains,” Chainalysis wrote. “They understand that centralized exchanges represent chokepoints with sophisticated compliance programs and user KYC, and attempt to avoid or delay interaction with them.”
The findings distinguish confirmed thefts from broader financial exposure. Chainalysis measured cryptocurrency successfully obtained by attackers, while CertiK later estimated $124 million in financial exposure during the first six months. The latter category can include ransom demands, assets placed at risk and other values associated with incidents rather than only completed thefts.
CertiK said in February that wrench attacks had climbed 75% during the prior year to a record 72 incidents, with France emerging as the epicenter.
French authorities charged 88 suspects in April across 12 investigations into organized groups accused of conducting violent crypto attacks. More than 10 of those charged were minors.
Authorities indicted a man in June who was accused of participating in a wrench attack after allegedly posing as a police officer.
Five men were convicted in London during the week of the Chainalysis release for imprisoning and torturing two French crypto millionaires as part of an extortion scheme.
Crypto-linked coercion also drew attention in the United States after ransom notes demanding Bitcoin surfaced during the investigation into the kidnapping of Nancy Guthrie, the mother of “Today” host Savannah Guthrie.
This article has been refined and enhanced by ChatGPT.
