France recorded 77 cryptocurrency-linked kidnappings, unlawful detentions, and extortion cases in the first half of 2026, according to Interior Minister Laurent Nuñez. The figure represents a 71% annualized increase over 2025, when 45 cases were logged for the full year. France now accounts for a...
"These are serious matters and your concern is legitimate." — Laurent Nuñez, French Interior Minister, addressing ADAN members on June 30, 2026
France recorded 77 cryptocurrency-linked kidnappings, unlawful detentions, and extortion cases in the first half of 2026, according to Interior Minister Laurent Nuñez. The figure represents a 71% annualized increase over 2025, when 45 cases were logged for the full year. France now accounts for an estimated 70% of all documented "wrench attacks" worldwide — physical coercion crimes targeting crypto holders — making the country the undisputed global epicenter of a rapidly escalating threat category.
The crisis has prompted a structured state response. France deployed a rapid-alert protection system in April 2026, which has enrolled 724 participants and contributed to 200 arrests. On June 30, Nuñez unveiled a three-pillar security plan built around intelligence sharing, industry partnership with the Association for the Development of Digital Assets (ADAN), and cross-border operational coordination. French prosecutors have charged 88 suspects — including more than 10 minors — across 12 active judicial investigations, with 75 placed in pre-trial detention.
The trend extends beyond France. CertiK recorded 34 verified wrench-attack incidents globally between January and April 2026, a 41% increase over the same period in 2025. Estimated losses for those four months reached $101 million. If the trajectory holds, 2026 will close with approximately 130 global incidents and total losses in the hundreds of millions of dollars.
The 77 cases confirmed by Nuñez encompass kidnapping, unlawful detention, extortion, and attempted versions of each. Annualized, the 2026 pace would yield approximately 154 cases — more than triple the 45 cases France documented in 2025 and roughly 8.5 times the 18 cases recorded in 2024.
France's Interior Ministry classifies these as "structured criminal network" operations rather than opportunistic street crime. The distinction matters: attackers are conducting pre-operational surveillance, sourcing target information from leaked databases, and coordinating cross-border logistics.
Since 2023, France has recorded a cumulative 135 crypto-related physical crime incidents: 18 in 2024, 67 in 2025, and 47 formally charged cases so far in 2026 (with the 77-case figure from Nuñez including attempted crimes and cases still under initial investigation).
The frequency works out to one crypto-linked physical crime every 2.4 days in France during H1 2026.
Three structural factors explain France's disproportionate exposure:
High crypto penetration. ADAN estimates approximately 11% of the French population — roughly 7.3 million people — owns cryptocurrency. This is among the highest retail ownership rates in Europe and provides a large target surface.
Data exposure. French law requires cryptocurrency service providers to collect and store extensive KYC data under the PSAN (Prestataires de Services sur Actifs Numériques) registration framework. Multiple data breaches at French crypto companies — most notably the 2020 Ledger breach that exposed 272,000 customer names, addresses, and phone numbers — have created durable target lists that criminal networks continue to exploit years later.
Pseudonymous wealth signals. On-chain activity is pseudonymous but not anonymous. Blockchain analytics firms and criminal groups alike can trace wallet balances. When combined with leaked personal data linking wallet addresses to physical identities, attackers can estimate holdings and select targets with precision.
France's position as a regulated crypto hub, with its MiCA-compliant framework and relatively high institutional activity, paradoxically creates a richer data trail than less regulated jurisdictions.
The victim profile has shifted materially since 2023. Early wrench attacks predominantly targeted high-net-worth individuals, exchange executives, and known crypto entrepreneurs. The May 2025 attempted kidnapping of Pierre Noizat's daughter and grandson — Noizat is CEO and co-founder of Paymium, one of France's oldest crypto exchanges — exemplified this initial pattern.
By 2026, the target set has expanded. Bloomberg's investigation into physical crypto attacks found that victims now include "children as well as blue collar workers like teachers and firemen." The shift follows a rational criminal calculus: high-profile targets have hired private security, while small holders remain exposed.
CertiK's data supports this pattern. Between January and April 2026, the firm documented a trend toward "proxy target selection" — attacking family members rather than the crypto holder directly. The January 2026 kidnapping of an 84-year-old relative of journalist Savannah Guthrie, with a $6 million Bitcoin ransom demand, illustrated the tactic at its most extreme.
The lowered target threshold has implications for the industry's security posture. Individual operational security measures designed for high-profile holders (private security details, undisclosed residences) are neither practical nor affordable for retail participants.
France's government response has evolved through three phases:
Phase 1 — Reactive (2023-2025). Standard law enforcement response to individual cases. No dedicated framework. Clearance rates were low and response times slow, reflecting the challenge of investigating crimes that cross digital and physical domains.
Phase 2 — Emergency System (April 2026). The Interior Ministry launched a rapid-alert and protection system specifically for crypto holders and industry professionals. Key features include a dedicated emergency hotline and identification system. As of Nuñez's June 30 briefing, 724 individuals had enrolled — an 11% increase from the initial enrollment. In one case in the Somme region, police arrested suspects within eight hours of a victim activating the system.
Phase 3 — Structured Plan (June 30, 2026). Nuñez unveiled what he described as a "more ambitious and structured action plan" built on three pillars:
Intelligence sharing. Expanded monitoring of cross-border networks. Nuñez stated that "intelligence sharing is fundamental and extremely effective," noting that many attack organizers operate from outside France while recruiting local participants for execution.
Industry partnership. Deeper institutional collaboration with ADAN through a dedicated expert network bringing together crypto sector representatives and government agencies. This marks a formal acknowledgment that law enforcement alone cannot address the threat without industry cooperation on threat intelligence.
Operational coordination. Reinforced coordination between police units, judicial authorities, and international law enforcement partners for faster identification and neutralization of perpetrators.
The 200 arrests reported by Nuñez represent both reactive apprehensions (post-attack) and preventive operations based on intelligence.
French prosecutors have charged 88 suspects across 12 active judicial investigations, according to reporting by Decrypt and confirmed by The Block. Of these, 75 have been placed in pre-trial detention. More than 10 of those charged are minors.
The charges span kidnapping, unlawful confinement, extortion, and money laundering — the last category reflecting attempts to convert stolen crypto assets through mixers, cross-chain bridges, and peer-to-peer exchanges.
The involvement of minors is consistent with the organized-crime model: criminal networks recruit young operatives for execution-level roles, calculating that they face reduced sentences under French juvenile law. The pattern mirrors recruitment practices documented in other organized crime contexts, including drug trafficking networks.
All 12 investigations are being handled by specialized magistrates at the Paris Judicial Court, indicating the cases have been elevated above the local prosecutor level.
France's crisis is the sharpest expression of a global trend. CertiK's 2025 annual report documented 72 verified physical coercion incidents worldwide, up 75% from 41 incidents in 2024. Losses exceeded $40.9 million. Kidnapping accounted for 25 of the 72 incidents (a 66% increase year-over-year), while physical assaults surged 250%, from 4 incidents to 14.
Between January and April 2026, CertiK recorded 34 verified incidents globally — a 41% increase over the 24 incidents in the same period of 2025. Estimated losses for Q1-April 2026 reached approximately $101 million. Extrapolating linearly, 2026 would close with approximately 130 incidents and losses potentially exceeding $300 million.
Europe accounted for over 40% of global incidents in 2025, up from 22% in 2024. France led with 19 attacks, followed by the United Kingdom and, at a distance, Italy and the United States.
Jameson Lopp, a Bitcoin security researcher who has maintained an open-source tracker of physical crypto attacks since 2014, recorded approximately 70 physical assaults in 2025 — the highest annual total in his decade-old log. Since 2020, Lopp has documented more than 215 cases globally, though he notes the count "likely understates the true total" because many victims do not report crimes.
Between 2022 and 2025, documented physical crypto incidents resulted in 6 deaths and $166 million stolen, with kidnapping accounting for 77% of physically stolen funds.
The wrench-attack epidemic has created a new product category in the specialty insurance market. Lloyd's of London syndicates have begun offering kidnap-and-ransom (K&R) policies tailored specifically to crypto holders — a segment that previously fell outside standard K&R coverage because of the asset class's perceived regulatory ambiguity.
Specialist firms report surging demand. Executive Risk Services, a private security firm, told Bloomberg that inbound client inquiries increased from roughly once per quarter two years ago to approximately once per week in 2026.
At least two dedicated products are in development: Relm Insurance and AnchorWatch both have crypto-specific K&R policies scheduled for launch. The policies are designed to cover ransom payments, crisis response costs, and post-incident relocation.
For context on the corporate end: Coinbase disclosed spending approximately $7.6 million on personal security for CEO Brian Armstrong in 2025, a 20% increase from the prior year. This figure, buried in the company's proxy statement, reflects the cost structure that the wrench-attack trend is imposing on crypto enterprises.
The wrench-attack crisis carries economic implications that extend beyond physical security. Three dynamics are worth noting:
Regulatory data collection creates attack surfaces. France's experience demonstrates an uncomfortable tension: the regulatory push for comprehensive KYC/AML compliance generates centralized personal data stores that, when breached, provide attackers with target lists. The 2020 Ledger data breach continues to fuel attacks six years later. This dynamic is not unique to France — it applies to any jurisdiction implementing rigorous identity verification for crypto services.
Retail adoption ceiling. If holding cryptocurrency creates physical risk for retail participants and their families, adoption faces a ceiling that no amount of UX improvement or regulatory clarity can address. The victim-profile shift toward ordinary holders suggests the security externality is no longer confined to wealthy early adopters.
Geographic arbitrage. Crypto businesses and high-value holders may begin relocating away from jurisdictions with high wrench-attack density. France's position as a European crypto hub — cemented by its early MiCA implementation — could be undermined if the security environment continues to deteriorate.
France's 77-case H1 2026 total represents a state-level security problem, not an industry curiosity. The French government's three-pillar response — intelligence sharing, industry partnership, and operational coordination — is the most structured state framework deployed against crypto-linked physical crime to date. Whether it is sufficient to reverse the trajectory remains an open question. The 200 arrests suggest enforcement capacity exists; the continued acceleration of new cases suggests the deterrence signal has not yet propagated through criminal networks.
For the broader Web3 ecosystem, the wrench-attack epidemic introduces a cost category — physical security — that protocol economics and token incentive models do not account for. The economic value generated by on-chain participation now carries an off-chain risk premium in certain jurisdictions. How the industry and regulators address this externality will shape adoption trajectories in ways that governance proposals and gas fee optimizations cannot.