Wrench Attacks Surge: $30M Stolen in H1 2026 as Physical Crypto Crimes Escalate

Woofun AI reports that physical coercion against crypto holders has intensified, with Chainalysis documenting a surge in "wrench attacks" targeting asset custodians globally. This escalation marks a critical shift in threat vectors, moving beyond digital custody failures to direct physical endangerment of individuals and their families.

The financial toll is mounting rapidly, with more than $30 million stolen in the first half of this year, positioning 2026 to exceed the $58 million record set in 2025. A Chainalysis report released Thursday identified 46 violent crypto-related incidents through late June, an increase from the 40 recorded in the same period last year. These events encompass kidnappings, home invasions, and hostage situations. Despite the higher volume, the success rate for attackers has declined to 26%, with only 12 of the 46 attempts resulting in payment, compared to a 49% success rate in 2025.

However, this metric likely underestimates the true scale, as many incidents remain unreported.

Structurally, the attacker tradecraft exhibits a distinct duality: amateur execution during the violent act but professional planning at both ends. Victims are frequently targeted using intelligence derived from data leaks, social media activity, or insider information. Once identified, low-skilled crews are deployed to carry out the physical assaults, separating the strategic reconnaissance from the operational violence. This division of labor allows criminal groups to minimize risk while maximizing the precision of their victim selection.

Per Woofun AI, France has emerged as the epicenter of this crisis, recording 30 publicly known incidents by midyear, a sharp rise from 19 throughout 2025. French authorities estimate the actual count exceeds 70 incidents, with Interior Minister Laurent Nuñez citing 77 kidnappings, extortions, or attempted extortions in July alone, up from 45 in all of 2025. The government has responded with a rapid-alert and protection system, aiming to improve coordination with the crypto industry. The surge is largely attributed to the alleged misuse of French tax records, where a French tax official reportedly sold investor data to criminals, compounded by a breach at crypto tax-reporting company Waltio that exposed approximately 50,000 users.

Onchain analysis reveals varying degrees of sophistication in fund disposal. While some attackers move stolen assets directly to centralized exchanges, others utilize bridges, decentralized exchanges, and specialized laundering services to obscure trails. The most advanced cases demonstrate clear links to broader criminal networks, indicating an evolving infrastructure for monetizing physical theft. This trend suggests that physical security breaches are increasingly integrated into larger, organized financial crime ecosystems.