Crypto 'wrench attacks' hit 52 in first half of 2026, with money targeted up more than tenfold

Physical attacks on crypto holders continued through the first half of 2026, with security firm CertiK counting 52 verified "wrench attacks" — in-person assaults, kidnappings and extortion used to force victims to hand over their coins — in a report published Wednesday, according to The Block.

The headline shift is the money involved. CertiK put total recorded financial exposure — ransom demanded plus funds actually stolen — at $124 million, up from $10.5 million a year earlier, a rise of more than 1,000%. The Block, citing CertiK, reported the same figures.

The threat is geographically lopsided. Europe accounted for 39 of the 52 verified incidents, and France alone for 33 — what CertiK called "the dominant national epicenter in the dataset." The firm also flagged a change in tactics: home invasions tied to crypto rose from one publicly reported case in H1 2025 to 20 in H1 2026. Kidnappings also increased, per CertiK, though it did not publish a separate count in the excerpted figures.

CertiK noted that the pace of attacks slowed in the second quarter even as the half-year total climbed — frequency easing while the sums at stake grew. The term "wrench attack" refers to coercion that bypasses digital security entirely; CertiK calls it an "established threat vector."

The firm's advice: limit public information linking your identity, location or routine to your holdings; split significant assets so no single person can move them, keeping wallets, signing devices and recovery material separate; harden home security; and keep sensitive accounts off devices used while traveling.

Key facts

• 52 verified wrench attacks in H1 2026; frequency slowed in Q2 (CertiK, via The Block).
• Total money demanded or stolen: $124 million, up from $10.5 million a year earlier — more than 1,000% (CertiK).
• Europe: 39 of 52 incidents; France alone: 33 (CertiK).
• Home invasions tied to crypto: 20 in H1 2026 vs. 1 in H1 2025 (CertiK).
• Report published Wednesday, July 22, 2026 (The Block).

The real-world read

The numbers come from a single firm's own dataset, so read them as CertiK's count, not an official tally. "Verified incidents" means publicly reported and confirmed by CertiK — the real figure is plausibly higher, since victims of extortion have strong reasons not to go public, which also makes the year-over-year jump partly a reporting-visibility artifact rather than purely a rise in attacks. The France concentration is striking enough to warrant caution: it may reflect genuine clustering, or simply that French cases draw more press coverage that feeds the dataset. CertiK is a security vendor whose business is protecting exactly these holders, so its recommendations, while sensible, are also adjacent to what it sells. None of that makes the trend fake — the tactical shift toward home invasions is specific and hard to wave away — but the precise dollar figure deserves the same skepticism as any self-published metric.

Opinion, and whose

CertiK characterizes home invasion as "the defining shift of H1 2026" and frames wrench attacks as an "established threat vector" — the firm's assessment, not settled fact. No independent corroboration of the totals appears alongside the report.

Sources

• The Block (RT Watson), July 22, 2026 — reported CertiK's findings and figures; reputable secondary source. Note: The Block discloses that Foresight Ventures, whose anchor LP is exchange Bitget, is its majority investor; it says it operates independently.
• CertiK report (primary), published July 22, 2026 — original dataset, figures and recommendations, as relayed by The Block. CertiK is a commercial security firm reporting on the threat its products address.

This is news reporting, not financial or security advice.