Physical coercion attacks against cryptocurrency holders—termed "wrench attacks"—caused $101 million in verified losses during January–April 2026, according to blockchain security firm CertiK. The firm documented 34 incidents in the period, a 41% increase over the same window in 2025, and project...
Physical coercion attacks against cryptocurrency holders—termed "wrench attacks"—caused $101 million in verified losses during January–April 2026, according to blockchain security firm CertiK. The firm documented 34 incidents in the period, a 41% increase over the same window in 2025, and projects 130 total attacks by year-end.
France has emerged as the global epicenter. The French Interior Ministry confirmed 41 crypto-related kidnappings and home invasions in 2026, averaging one every 2.5 days. Authorities have charged 88 suspects across 12 active judicial investigations, including more than 10 minors. The crisis prompted Binance to deploy a "Withdraw Protection" feature on May 4 that locks outgoing transfers for 1–7 days, and has triggered an emergency government response plan from France's Interior Ministry.
The data indicates a structural shift in crypto-adjacent crime: as protocol and wallet security hardens, attackers increasingly target the human layer—holders, executives, and their families—using open-source intelligence, leaked data, and surveillance to identify targets.
CertiK's 2026 Wrench Attacks Overview documents the following:
| Metric | Value | |--------|-------| | Verified incidents (Jan–Apr 2026) | 34 | | Year-over-year increase | +41% | | Estimated losses (Jan–Apr) | $101 million | | Full-year projection | 130 attacks | | European share of incidents | 82% (28 of 34) | | France share of European attacks | 24 of 28 |
Jameson Lopp, Chief Security Officer at Casa and maintainer of the public physical-bitcoin-attacks tracker on GitHub, has cataloged 316 kidnap-and-ransom incidents since 2014. His dataset recorded 79 attacks in 2025 and 27 in the first months of 2026.
The discrepancy between Lopp's 27 and CertiK's 34 reflects differing verification methodologies. Both datasets agree on the directional trend: accelerating frequency and geographic concentration in Western Europe.
France accounts for approximately 40% of Europe's crypto ransom attacks according to CoinDesk reporting. The French Interior Ministry's figures:
The rate in 2026 translates to one attack approximately every 2.5 days. French officials attribute the concentration to several factors: a large domestic crypto-holder population, publicly accessible property records, and organized criminal networks that have professionalized around the theft vector.
Jean-Didier Berger, Minister Delegate to the Interior Ministry, stated at Paris Blockchain Week that a "more stringent response plan" is under development with Interior Minister Laurent Nuñez.
Ledger Co-Founder Abduction (January 2025): David Balland, co-founder of hardware wallet manufacturer Ledger, and his wife were abducted from their home. Attackers severed one of Balland's fingers and transmitted proof to associates while demanding ransom. Multiple suspects were arrested. The last fugitive, a 24-year-old French national, was apprehended in Spain in March 2026 after 14 months in flight.
Paymium CEO's Daughter (May 2026): Three masked men attempted to forcibly abduct the daughter of Pierre Noizat, CEO of French exchange Paymium, in broad daylight in Paris. Passersby intervened and the attempt failed. The incident demonstrated attackers' willingness to target relatives in public spaces.
Burgundy Hostage Case (April 2026): A mother and her young son were kidnapped from their home in Burgundy. After approximately 20 hours of captivity, law enforcement intervened and secured their release.
These cases illustrate the operational shift CertiK identified: attackers increasingly target family members as leverage proxies rather than the crypto holder directly.
CertiK's report describes a transition from opportunistic street crime to "structured criminal enterprise." Key characteristics of 2026-era wrench attacks:
Data-driven targeting. Attackers compile dossiers using blockchain analytics, leaked exchange KYC data, social media, property records, and vehicle registrations. Physical surveillance is often unnecessary once digital intelligence is gathered.
Proxy targeting. Rather than confronting a technically sophisticated holder who may have duress mechanisms, attackers kidnap family members to coerce remote transfers.
Operational professionalism. CertiK documents cases involving multi-person teams with designated roles: surveillance, physical seizure, device operation, and extraction. Some networks operate across borders.
Declining technical sophistication of victims. As crypto wealth diffuses beyond early adopters, targets increasingly lack operational security awareness. The CertiK report notes that many 2026 victims had no hardware wallets, no multisig configurations, and substantial balances on single-device hot wallets.
Binance Withdraw Protection (launched May 4, 2026): A user-activated lock that halts all on-chain withdrawals for 1–7 days (default: 48 hours). Account access and trading remain functional; only outgoing crypto transfers are blocked. The feature is designed to render forced transfers futile, as attackers cannot extract assets within the window and the victim can subsequently revoke access.
According to Binance's announcement, the feature was developed specifically in response to the wrench-attack surge. CoinDesk reported that Binance consulted with French law enforcement during development.
No equivalent feature has been publicly announced by Coinbase, Kraken, or OKX as of May 10, 2026.
The French government's response has three components:
Criminal prosecution: 88 suspects charged across 12 active investigations. More than 10 are minors. The alleged mastermind of the Ledger kidnapping was arrested in Morocco in June 2025.
Prevention platform: A new government-operated platform launched at Paris Blockchain Week provides threat alerts, security guidance, and direct communication channels between crypto holders and law enforcement. The platform has drawn thousands of registered users.
Operational measures (in development): A dedicated police unit focused on crypto-related physical crime, faster international coordination protocols, expanded blockchain analytics for ransom tracing, and public awareness campaigns.
France's internal security directorate (DGSI) has been mobilized, a step typically reserved for terrorism-related threats.
The wrench-attack epidemic has accelerated adoption of physical-security-aware custody architectures:
Casa multisig: Distributes signing authority across 3–5 keys held on separate devices in separate locations. No single physical confrontation can access sufficient keys to move funds. Casa's Gold tier (one hardware wallet, mobile key, Casa recovery key) and Platinum tier (three hardware wallets, mobile key, Casa recovery key) are explicitly designed against duress scenarios.
Duress wallets: Hardware wallets from Ledger and Trezor support hidden passphrases. Under coercion, a user can reveal their primary PIN and seed phrase, exposing only a low-balance decoy wallet. The passphrase-protected wallet containing primary holdings remains undiscovered. Casa's blog notes this provides "plausible deniability" under physical pressure.
Time-locked transactions: Some custody solutions implement Bitcoin-native timelocks (CheckSequenceVerify) that make immediate transfers technically impossible regardless of key access.
The limitation, as Casa CEO Nick Neuman has noted, is adoption. The majority of crypto holders—particularly those new to the space—do not use multisig, do not configure duress wallets, and maintain significant balances accessible from a single device.
Bermuda-based Relm Insurance launched a specialized kidnap-and-ransom (K&R) product in 2025 tailored to Web3 executives and high-net-worth crypto holders. The product provides crisis response consulting, negotiation support, and fund reimbursement.
Lloyd's of London syndicates have begun including wrench-attack coverage in broader executive-protection policies, according to NBC News reporting. Premiums vary based on geographic exposure, public profile, and custody architecture.
The insurance market for crypto-physical security remains nascent. Underwriting challenges include the difficulty of verifying on-chain losses, the pseudonymous nature of assets, and the lack of actuarial history for this specific risk category.
Publicly disclosed security expenditures for crypto executives:
| Company | Executive | Annual Security Spend | Year | |---------|-----------|----------------------|------| | Coinbase | Brian Armstrong | $6.2 million | 2025 | | Robinhood | Vlad Tenev | $1.6 million | 2024 | | Circle | Jeremy Allaire | $800,000 | 2024 |
These figures, drawn from regulatory filings, reflect only disclosed corporate expenditures. Actual spending including personal arrangements is likely higher.
The executive-protection market—encompassing crypto, technology, and finance—is estimated at $120.3 billion globally in 2026 according to industry reports. Crypto-related demand has driven a subsegment characterized by 24/7 armed details, residence hardening, counter-surveillance, and digital-footprint reduction.
The $101 million lost to wrench attacks in four months represents a category of crypto risk that exists entirely outside the blockchain. No smart-contract audit, protocol upgrade, or consensus mechanism can address it. The threat is a direct function of two variables: identifiable wealth and accessible humans.
France's crisis is a preview. As crypto adoption expands and exchange KYC databases accumulate more identifying information linking individuals to balances, the attack surface grows. The industry's response has been fragmented—one exchange feature, a handful of multisig providers, an emerging insurance niche.
The structural solution requires making forced transfers technically impossible for the average holder, not just the security-conscious minority. Until custody defaults change—until multisig or time-locks become standard rather than optional—wrench attacks will remain the economically rational path for organized criminals.