Physical attacks targeting cryptocurrency holders rose 75% in 2025 to 72 confirmed incidents globally, with losses exceeding $40.9 million, according to CertiK's Skynet Wrench Attacks Report published February 3, 2026. The trend is accelerating: 11 incidents were recorded in January 2026 alone. F...
"These serial kidnappings will be combated with specific tools, both immediate and short-term, to prevent, deter and hinder in order to protect the industry." — Bruno Retailleau, French Interior Minister
Physical attacks targeting cryptocurrency holders rose 75% in 2025 to 72 confirmed incidents globally, with losses exceeding $40.9 million, according to CertiK's Skynet Wrench Attacks Report published February 3, 2026. The trend is accelerating: 11 incidents were recorded in January 2026 alone. France has emerged as the global epicenter, logging more wrench attacks than any other country.
On April 13, 2026, a mother and her ten-year-old son were kidnapped from their home in Burgundy and held for 20 hours while attackers demanded "several hundreds of thousands" of euros from the father, a cryptocurrency entrepreneur. Counter-terrorism officers from France's GIGN freed the pair and arrested four suspects on April 15. The incident was the latest in a pattern that has prompted the French Interior Ministry to convene emergency meetings with crypto industry leaders and propose a dedicated protection unit for high-value holders.
The data reveals a structural problem: as crypto markets mature and asset values concentrate, the pseudonymous wealth stored on transparent blockchains creates a target set for organized criminal groups. The security perimeter of digital assets now extends well beyond private keys and smart contracts into the physical world.
CertiK's Skynet report, drawing from law enforcement records, media coverage, and on-chain forensics, documents the following trajectory:
| Year | Confirmed Incidents | Estimated Losses | YoY Change (Incidents) | |------|-------------------|------------------|----------------------| | 2023 | ~24 | $12.4M | — | | 2024 | 41 | $28.3M | +71% | | 2025 | 72 | $40.9M | +75% | | 2026 (Jan only) | 11 | N/A | Annualized: ~132 |
The true count is likely higher. CertiK notes that many incidents are logged by local police as ordinary robberies and never surface in crypto-specific databases. The term "wrench attack" — a reference to the xkcd comic depicting a $5 wrench used to bypass encryption — now encompasses kidnapping, home invasion, physical assault, torture, and extortion.
Kidnapping was the most common tactic in 2025, accounting for 25 of 72 incidents (35%), up 66% from 15 cases in 2024. Physical assaults surged 250%, rising from 4 confirmed cases in 2024 to 14 in 2025. Three murders were recorded.
Europe accounted for over 40% of all global wrench attacks in 2025, up from 22% in 2024. France recorded the highest national incident count worldwide, surpassing the United States.
The French attack timeline includes several high-profile cases:
January 2025: Kidnappers abducted Ledger co-founder David Balland and his wife from their home in Vierzon, demanding a €10 million ransom from fellow co-founder Eric Larchevêque. The attackers severed one of Balland's fingers and sent a photograph to Larchevêque to coerce payment. GIGN officers freed the couple and arrested the suspects.
May 2025: The daughter of Pierre Noizat, co-founder and CEO of French exchange Paymium, was targeted in a daylight kidnapping attempt in Paris's 11th arrondissement. Passers-by intervened and stopped the attack.
February 2026: A mother and daughter were rescued by a passerby from a crypto-linked kidnapping, according to CNN reporting.
April 13-15, 2026: The Burgundy kidnapping — a mother and ten-year-old son held for 20 hours in a hotel in Val-de-Marne. GIGN freed them and arrested at least four suspects. The father, a crypto entrepreneur, did not pay the ransom.
Four separate kidnapping attempts occurred within a four-day period in early January 2026, according to Cryptopolitan. By April 2026, at least 19 crypto-related violent incidents had been reported in France for the year.
The CertiK report and law enforcement analyses describe an evolution from opportunistic street crime to premeditated, organized operations. Several patterns emerge:
Reconnaissance: Attackers mine open-source intelligence — social media posts, forum activity, public blockchain data, and delivery app accounts. In multiple French cases, criminals infiltrated food delivery platforms to obtain home addresses of targets.
Target Selection: On-chain transparency is a double-edged tool. While blockchain analytics serve compliance and law enforcement, they also allow adversaries to estimate wallet balances tied to known identities. Pseudonymity breaks down at the on-ramp and off-ramp points where users interact with KYC-compliant exchanges.
Operational Structure: According to the Organized Crime and Corruption Reporting Project (OCCRP), French authorities arrested over 20 suspects connected to a network of crypto kidnappings. The structure suggests transnational organized groups that outsource physical operations to local operatives while coordinating logistics remotely.
Coercion Methods: Attackers demand access to hardware wallets, seed phrases, or direct transfers from exchange accounts. The irreversibility of blockchain transactions eliminates the recovery options available in traditional financial crime. Once funds are transferred, they are typically laundered through mixers or cross-chain bridges within minutes.
Two data breaches have compounded the physical security risk for French crypto holders:
The Waltio Breach: On January 21, 2026, French crypto tax reporting platform Waltio disclosed that a "sophisticated" attacker had exfiltrated data from approximately 50,000 users. The exposed data included email addresses, aggregated tax report information, and gains/losses balances — sufficient to identify high-value targets. Waltio stated that passwords, wallet addresses, and transaction histories were not compromised. A hacker group subsequently claimed a connection between the Waltio data and the French kidnapping wave, though investigators have not confirmed a direct link.
Tax Office Insider: French authorities are investigating allegations that an employee of the tax agency sold sensitive lookup results about crypto investors to criminal networks. The investigation is ongoing, but the allegation highlights a fundamental vulnerability: centralized databases of crypto wealth — whether held by exchanges, tax platforms, or government agencies — create honeypots for adversaries seeking to identify targets.
The Ledger customer database breach of 2020 — which exposed names, addresses, and phone numbers of 272,000 hardware wallet buyers — continues to circulate on dark web forums, illustrating the long tail of data exposure. That breach preceded the attack on Ledger's own co-founder by five years.
The French government has escalated its response in phases:
Phase 1 — Emergency Meeting (May 2025): Interior Minister Bruno Retailleau convened an emergency meeting with crypto industry leaders following the attempted Paymium kidnapping. He outlined a plan including special emergency contact numbers for crypto professionals and measures to hide personal addresses in official registers.
Phase 2 — Law Enforcement Action: French authorities charged 25 suspects in connection with a series of crypto kidnappings, per OCCRP and Cointribune reporting. Over 20 were arrested in coordinated operations.
Phase 3 — Structural Measures (Under Discussion): A dedicated protection unit for crypto industry leaders is under discussion. The Interior Ministry has promised an "emergency plan" against crypto-targeted crimes. Proposals include restricting public access to business registration databases that reveal founder addresses.
The Solace Global threat intelligence firm published a dedicated briefing on crypto wrench attacks in early 2026, recommending that high-net-worth crypto holders implement physical security protocols equivalent to those used by traditional finance executives: residential security assessments, travel route variation, social media operational security, and separation of known identity from on-chain activity.
While France leads incident counts, the problem is not confined to one jurisdiction:
United States: Wrench attacks surged in California in early 2026, per CoinAlert News. In one notable case, teenagers drove 600 miles to allegedly attempt a $66 million crypto robbery, according to The Block. They face felony charges.
Spain and Sweden: Both recorded elevated incident counts in 2025 within the European region.
Global Distribution: CertiK's data shows attacks spanning Asia, Latin America, and Africa, though with lower frequency. The geographic spread correlates broadly with crypto adoption density and, critically, with the availability of personal data linking individuals to crypto wealth.
The pattern suggests that as regulatory frameworks mandate more KYC data collection, the attack surface for physical targeting expands. Each data point collected for compliance purposes — name, address, photo ID, source of funds — becomes a potential intelligence input for adversaries if breached or leaked.
The wrench attack wave carries implications beyond individual security:
Insurance and Custody: Institutional custodians have long accounted for cyber risk in their security models. Physical coercion risk — the possibility that an authorized signer could be forced to approve transactions under duress — is now a documented threat vector. Multi-party computation (MPC) and time-locked transactions partially mitigate this risk, but do not eliminate it when family members are held hostage.
Talent and Location Decisions: The concentration of attacks in France has raised questions about whether crypto companies and founders will relocate. Several French crypto executives have reportedly adopted enhanced personal security measures or relocated family members, though specific migration data is not publicly available.
Regulatory Feedback Loop: The kidnapping wave creates political pressure that can influence regulatory posture. On one hand, it strengthens the case for privacy-preserving technologies. On the other, it reinforces government arguments for greater surveillance and control of crypto transactions to trace ransom payments.
On-Chain Transparency Trade-off: The industry faces a fundamental tension. Blockchain transparency — the ability for anyone to verify transactions and balances — is a core value proposition for auditability, compliance, and trustless settlement. That same transparency, combined with identity linkage at regulated touchpoints, produces a target map for physical adversaries.
The wrench attack surge represents a market externality that the crypto industry has been slow to price. Digital security — smart contract audits, bug bounties, and key management — absorbs billions in annual spending. Physical security for the humans who control those keys receives a fraction of that investment.
The data indicates that the problem will worsen before it improves. Attack sophistication is increasing. Organized crime networks are developing crypto-specific operational playbooks. Data breaches at third-party service providers continually refresh the target list. And the fundamental transparency of public blockchains, combined with mandatory identity verification at regulated access points, ensures a persistent information asymmetry favoring attackers.
The French government's response — emergency meetings, arrests, proposed address redaction — addresses symptoms. The underlying condition is architectural: the crypto industry has built a financial system where wealth is both publicly visible and instantly extractable under duress. Until that design tension is resolved, whether through time-locked transactions, duress codes, MPC threshold requirements, or other mechanisms, the physical security perimeter of digital assets will remain the weakest link in the chain.