Wrench Attacks on Crypto Hit 52 in H1 2026; Losses $124M

CertiK reported 52 verified wrench attacks on cryptocurrency holders in the first half of 2026. Recorded financial exposure, which includes ransom demands and funds stolen in those incidents, reached $124 million, up from $10.5 million in H1 2025.

Incidents persisted through the second quarter even as frequency eased. The report noted the year-over-year increase in financial exposure exceeded 1,000%, driven by a small number of high-value cases.

The attacks were geographically concentrated. Western Europe accounted for 39 of the 52 verified incidents, with France alone responsible for 33 cases, the report wrote.

Wrench attacks involve physical assault or extortion intended to force victims to surrender private keys, seed phrases or access to wallets. The method can bypass digital security measures and is aimed at obtaining control of crypto assets through coercion.

Tactical shifts identified in H1 2026 included a sharp rise in home invasions tied to crypto holdings, increasing from one publicly reported incident in H1 2025 to 20 in H1 2026. The report also recorded an increase in kidnappings linked to attempts to seize crypto assets.

To reduce risk, CertiK recommended limiting public information that links a person’s identity, location or routine to their crypto holdings; storing significant assets so they cannot be accessed or immediately transferred by a single individual; keeping wallets, signing devices and recovery material separate; strengthening home security; preparing emergency plans with family; and avoiding use of devices carried while traveling for sensitive accounts.

Incident counts did not rise dramatically overall, while recorded ransom demands and theft totals were substantially larger than in H1 2025.