In this article · 6 sections
A 'wrench attack' is the physical version of a hack: instead of breaking the software, criminals threaten the owner until they send the coins. These attacks are rising, and in 2026 France became the country with the most cases. CertiK counted 52 verified attacks worldwide in the first half of 2026, up from 39 a year earlier. The single most useful protection is not a device. It is making sure nobody can easily find out that you hold crypto, where you live, or that you are able to send a large amount on the spot.
The short answer
Keep your holdings private, make large transfers impossible to do alone and on the spot, and protect the personal data that leads criminals to your door. If it happens, your safety comes first: no amount of crypto is worth resisting an armed attacker. The rest of this page explains the data and the practical steps.
The numbers for 2026
Counts differ because each source defines an attack differently. Chainalysis counts publicly known cases; the French government counts every incident reported to police, including attempts and extortion.
| Measure | Figure | Source |
|---|---|---|
| Verified wrench attacks worldwide, H1 2026 | 52 (39 in H1 2025); about $124.1M in estimated exposure | CertiK, 25 Jul 2026 |
| Stolen in successful attacks, 2026 to mid-year | More than $30M (full-year 2025 record: $58M) | Chainalysis, via The Block, 6 Aug 2026 |
| Share of attempts where victims paid | 26% through late June 2026 (49% in 2025, 67% in 2024) | Chainalysis |
| France: publicly known cases, 2026 to mid-year | 30 (19 in all of 2025) | Chainalysis |
| France: incidents reported to authorities, H1 2026 | 77 kidnappings, extortions or attempts (45 in all of 2025) | French Interior Minister, 30 Jun 2026, via Cointelegraph |
| Type of attack, 2026 | Kidnappings 52%, home invasions 37% (14% in 2025) | Chainalysis |
Sources: CertiK Intel3d H1 2026 wrench attacks report (GlobeNewswire, 25 Jul 2026) · The Block / Chainalysis, 6 Aug 2026 · Cointelegraph, 2 Jul 2026
How attackers find their targets
Chainalysis considers leaked data the likeliest driver of the French wave. It points to a French tax official alleged to have sold files on wealthy crypto holders in 2024, made public in January 2026, and a breach at the crypto tax-reporting firm Waltio affecting about 50,000 users the same month. Attacks accelerated after both. In more than 40% of French cases, family members or acquaintances were targeted rather than the holder.
Older leaks still circulate: Ledger's 2020 customer database exposed more than 270,000 records, and Ledger co-founder David Balland was kidnapped with his partner in January 2025 before police freed them. In August 2026, the French tax administration (DGFiP) confirmed that data on about 678,000 taxpayers had been extracted using a stolen agent account: names, postal and email addresses, phone numbers and reference tax income. There is no evidence that crypto holdings were in that file, but an address plus an income figure is exactly what targeted phishing and physical targeting need.
Sources: The Block / Chainalysis · Cointelegraph (Ledger 2020 leak, Balland) · CybelAngel, 21 Aug 2026 (DGFiP breach)
Get the Exchange Safety Checklist
Plus an alert whenever a top exchange changes its proof-of-reserves, licensing or security status. No spam, unsubscribe anytime.
We store only your email to send the checklist and safety alerts. See our privacy policy.
Be a harder target: discretion
Attackers pick people they can find and believe to be rich. Make both harder.
- Don't talk about your holdings, gains or wallet brand online, at work or at the gym; screenshots travel
- Have hardware wallets and crypto merchandise delivered to a pickup point or office, not your home
- Use a separate email address for exchanges and crypto services, never your everyday one
- Ask data brokers and people-search sites to delete your address; in the EU you can invoke your GDPR right to erasure
- Assume any letter, call or visit about your crypto is a scam until verified through official channels
Be a harder target: make the coins hard to move on the spot
The attackers' plan depends on you being able to send everything in minutes. Remove that ability for your savings. Some holders also keep a decoy wallet with a modest amount; it is no guarantee, and attackers who already know your balance will not be fooled.
- Keep only a small 'spending' balance on your phone and on exchanges
- Hold savings in a multisig that needs a second key you do not keep at home, or that a trusted person or service must co-sign
- Store recovery phrases away from home, split if needed, and never as a photo
If it happens
Comply and stay safe. Call emergency services as soon as you can (112 in the EU, 911 in the US, 999 in the UK). Afterwards, write down every detail, note the addresses funds were sent to, and contact the exchanges and stablecoin issuers involved quickly: some transfers can be frozen. In France, the government says it has set up a dedicated prevention platform and rapid alert system for crypto holders; ask the police or gendarmerie about it.
Keep reading
Quick answers
What is a wrench attack?
A robbery in which criminals use violence or threats against a crypto holder, or their family, to force a transfer. The name comes from a well-known cartoon: no encryption survives a five-dollar wrench.
Why is France so affected?
Chainalysis points to leaked personal data, including files allegedly sold by a tax official and a breach at a crypto tax firm in January 2026, and to organised groups repeating a method that worked. France also has a large number of crypto holders.
Does a hardware wallet protect against wrench attacks?
Not on its own: if you can unlock it, so can someone threatening you. Multisig with a second key stored elsewhere, and discretion about what you own, are what reduce the risk.