Physical violence targeting cryptocurrency holders is escalating at an unprecedented rate in 2026, with attackers employing increasingly sophisticated methods to extract digital assets directly from victims. Blockchain analytics firm Chainalysis has documented more than $30 million stolen through these so-called "wrench attacks" during the first half of the year, putting 2026 on track to become the most damaging year yet for this category of crime Decrypt.
The term "wrench attack" refers to physical coercion—often involving threats or actual violence—to force cryptocurrency holders to transfer funds from their wallets. Unlike traditional cyber theft that operates remotely, these incidents bring the threat directly into victims' homes and personal spaces. Chainalysis data reveals that while 46 documented attempts have occurred, only 12 resulted in actual payment to attackers, suggesting many victims resisted or successfully protected their assets Cointelegraph.
France has emerged as the leading global hotspot for these violent encounters, a development that has surprised security researchers who previously tracked such incidents primarily in jurisdictions with higher overall violent crime rates. The concentration of attacks in France indicates that attackers are conducting targeted reconnaissance of cryptocurrency holders, possibly exploiting data leaks and public blockchain information to identify victims with substantial holdings The Block.
The attack vectors are evolving beyond direct confrontation. Security analysts note that perpetrators are increasingly targeting relatives of known cryptocurrency holders when the primary target proves inaccessible, expanding the circle of physical risk beyond individual holders to their families. This tactical shift demonstrates how attackers are adapting their approaches based on operational experience and the specific circumstances of their targets Cointelegraph.
Laundering techniques for the stolen proceeds have also grown more sophisticated. Chainalysis observes that attackers are developing more complex methods to obscure the trail of stolen cryptocurrency, complicating recovery efforts and law enforcement investigations. These enhanced laundering capabilities suggest organizational learning among criminal networks executing these physical attacks Decrypt.
The geographic concentration in France, combined with the relatively low success rate of 12 payments from 46 attempts, presents a complex picture for security professionals. While the majority of targeted individuals have apparently avoided losing funds, the escalating volume of attempts and the increasing brutality of methods indicate that deterrence through technical security measures alone may be insufficient. The extension of attacks to family members represents a particularly troubling development, as it undermines the security assumptions that many holders rely upon when assessing their personal risk profiles The Block.
With six months remaining in 2026, the current trajectory suggests annual losses could substantially exceed the mid-year figure, particularly if the observed pattern of geographic expansion and tactical refinement continues among criminal networks.