When the Hardware Wallet Won't Save You: Home Raids Overtake Kidnaps as Crypto's Favorite Wrench 🪛

Violent, physical attacks on crypto holders surged in the first half of 2026, with home invasions overtaking kidnappings as the most common form of so-called "wrench attack," according to a new report from blockchain security firm CertiK. CertiK verified 52 wrench attacks worldwide in H1 2026, a 33.3% increase from 39 incidents during the same period in 2025. Recorded financial exposure linked to the attacks reached approximately $124.1 million, up from $10.5 million a year earlier. The firm cautioned that the figure includes ransom demands, victim transfers, frozen or recovered assets and failed ransom demands, not only confirmed thefts, and that under-reporting remains severe as victims fear retaliation or reputational damage.

The defining shift was a 20-fold rise in home invasions, which climbed from a single publicly reported case in H1 2025 to 20 incidents in the first half of 2026, representing roughly 41% of all verified attacks. Kidnappings rose to 16 from 12, robberies declined from five to one, and one murder was recorded in each period. CertiK described an increasingly professional and layered model in which organizers purchase stolen personal data and coordinate logistics above disposable operators recruited on messaging apps, assembling "target packages" from leaked databases, exchange records and on-chain activity.

Geographically, the threat narrowed into a Western European crisis. Europe accounted for 39 of the 52 verified incidents, and France alone recorded 33, or roughly two-thirds of the global total. CertiK linked France's prominence to its large, visible crypto ecosystem and a series of data breaches, including the France Travail and ANTS incidents, that gave attackers ready-made target lists linking identities and home addresses to perceived crypto wealth. On July 2, French Interior Minister Laurent Nuñez said authorities had logged 77 crypto-linked kidnappings, extortion cases or attempted extortion cases during the first half of 2026, up from 45 across all of 2025, and that emergency measures had resulted in 200 arrests. French authorities have also launched a dedicated prevention platform and a rapid-alert system for crypto holders and professionals.

The trend fits a longer escalation. CertiK previously recorded 72 wrench attacks across all of 2025, a 75% jump from 2024, a year whose most harrowing case was the January kidnapping of Ledger co-founder David Balland and his wife in France, in which captors severed one of Balland's fingers to pressure a multi-million-euro ransom before police freed the couple. The rise in physical coercion is also reshaping self-custody guidance, as CertiK warned that a hardware wallet or hidden seed phrase offers little protection if the owner can be forced to unlock it. The firm recommended multisignature or multiparty computation arrangements, withdrawal delays, spending limits and geographically separated signers so that a single threatened individual cannot immediately release all available assets, alongside family "duress" protocols and tighter data minimization as a physical-safety measure.