Wrench Attacks Steal Over $30M in 2026, With France as Top Hotspot

Physical coercion theft targeting crypto holders has crossed $30 million in 2026 year-to-date, according to new data from Chainalysis, with France emerging as the leading geographic concentration point for what the industry calls "wrench attacks."

The term refers to in-person robberies where perpetrators use physical force or the threat of violence to compel victims to surrender private keys, seed phrases, or direct wallet transfers. Unlike protocol exploits or exchange hacks, these attacks bypass cryptography entirely. They target the human holding the keys.

Chainalysis documented 46 separate wrench attack attempts so far this year. Only 12 resulted in successful payment extraction, a conversion rate of roughly 26%. That low success rate is notable, but the $30 million figure suggests the 12 that did succeed involved substantial holdings. Attackers are not casting wide nets; they are identifying high-value targets.

The blockchain analytics firm says home invasions are becoming more common, France has emerged as the leading hotspot, and some attackers are using increasingly sophisticated laundering techniques.

Chainalysis

The threat surface is expanding beyond direct victims. Chainalysis flagged a pattern of attacks on relatives and incidents involving data leaks that expose wallet holders to secondary targeting. This shift toward indirect pressure tactics mirrors organized criminal behavior in traditional financial crime, where family members are used as leverage when a primary target proves resistant. For crypto holders, personal operational security cannot be treated as an individual concern in isolation.

France's emergence as the leading hotspot warrants scrutiny. The country has seen several high-profile incidents in recent months, including a January kidnapping targeting the father of a crypto exchange founder and a separate attack on a prominent entrepreneur. French authorities have since announced dedicated task forces, but the concentration of incidents may reflect a combination of factors: visible wealth signaling by local crypto figures, gaps in physical security culture within the community, and the relative ease of identifying large holders through public blockchain data cross-referenced with social media. Whether France represents a regional anomaly or an early signal of broader geographic spread remains unclear.

Sophisticated post-theft money movement suggests some attackers are not opportunistic criminals but organized actors with access to mixing infrastructure or complicit over-the-counter desks. The complexity of laundering required may indicate that blockchain surveillance and exchange compliance have improved enough to make raw fund movement difficult, forcing criminals to invest more in obfuscation. That is a backhanded indicator of progress in on-chain monitoring.

The 2026 data represents a meaningful escalation from prior years, when wrench attacks were documented sporadically and often went unreported entirely. The $30 million figure almost certainly understates actual losses. Chainalysis can only track cases that surface through law enforcement referrals, victim disclosures, or on-chain forensics. Unreported incidents, particularly those where victims comply quietly to avoid publicity, do not enter the dataset.

For market participants, the practical takeaway is structural. Hardware wallets and multi-signature setups reduce vulnerability by ensuring no single person can authorize a transfer under duress without a second factor held elsewhere. Custody arrangements that introduce time delays or institutional co-signers further complicate coerced transfers. Some holders have adopted "duress wallets," accounts holding a small fraction of total holdings that can be surrendered without exposing the bulk of assets. None of these measures eliminate risk, but they change the calculus for attackers who depend on speed and surprise.

Physical crypto theft sits at an uncomfortable intersection of financial crime law, property law, and personal safety. Jurisdictions with clear frameworks for reporting and prosecuting such incidents will likely see better data and, eventually, stronger deterrence. France's current moment as the documented epicenter may accelerate that process domestically. Whether other regulators treat this Chainalysis data as a prompt for action remains to be seen.