What Is a Wrench Attack? How Criminals Physically Target Crypto Holders in 2026
Wrench attacks are the one crypto crime that needs no vulnerability at all. Kidnappings, home invasions and coerced transfers took a record $58 million in 2025, and 2026 is running worse. Here is how the targeting works — and what actually lowers your risk.
What a Wrench Attack Actually Is
A wrench attack is an in-person crime in which violence or the threat of violence is used to make a crypto holder hand over funds. Nothing is hacked: no malicious signature, no drained approval. Someone stands in your home, or holds you in a car, until you unlock the wallet yourself and send the balance.
The name comes from an old thought experiment: a $5 wrench defeats any encryption if its owner will use it on the person holding the key. Every other attack on this blog assumes the attacker is far away. Wrench attacks assume they are in the room.
The 2026 Numbers Point the Wrong Way
Chainalysis recorded a record $58 million stolen through violent crypto attacks in 2025, then roughly $30 million in the first half of 2026, with 46 documented incidents by mid-year against 40 a year earlier. It expects 2026 to be the worst year on record.
CertiK counted 52 confirmed incidents in H1 2026, up 33% year over year, and put recorded exposure at $124.1 million — including ransoms, funds sent and amounts later frozen or recovered. Average exposure per incident rose from about $270,000 to $2.4 million; home invasions went from one reported case to 20.
The falling success rate is not the good news it looks like
Only 26% of recorded attempts produced a payment in 2026, down from 49% in 2025 and 67% in 2024. That is not better defences. It reflects a flood of poorly planned attacks run by people who could not move the funds once inside — the hammers case below needed a man on a video call to walk them through a phone.
Why Your Hardware Wallet Does Nothing Here
A hardware wallet protects you from a remote attacker, not from someone holding a hammer. The attacker does not need the seed phrase, only you pressing the buttons. The device becomes the tool, not the defence.
In December 2025, three masked men forced their way into a Solihull, England home, beat a trader with hammers for 45 minutes and threatened to kill his seven-months-pregnant wife unless he transferred several hundred thousand pounds in crypto. A fourth waited in the car; a fifth, on a live FaceTime call, talked the intruders through his apps. Settlement is final in seconds, with no chargeback or insurer behind a self-custody balance.
How Targets Get Picked
These are not random robberies. Chainalysis found victims are overwhelmingly local residents — 93% in France, 82% in Brazil, 77% in the US — implying real reconnaissance rather than opportunism.
- Government and tax records. A French tax official allegedly sold dossiers on wealthy crypto holders: names, home addresses, holdings, phone numbers and tax returns.
- Tax and portfolio software. Crypto tax platform Waltio disclosed a breach affecting roughly 50,000 users in January 2026.
- Exchange KYC data. A leaked customer database is effectively a list of names tied to verified balances.
- Public socials. A rented supercar, a conference badge, a “quit my job to trade full-time” post or an ENS name tied to your real identity all narrow the search.
France became the epicentre: 30 publicly known incidents in H1 2026, about 4.6 a month against a history of less than one, with authorities citing more than 70. Police secured roughly 200 arrests and 88 indictments by mid-year.
The Shift to Family Members
Attackers increasingly avoid the holder entirely. By early 2026, 25–30% of cases globally targeted a relative or acquaintance, up from near zero in 2021; in France the share exceeded 40%. Kidnapping a trader’s father produced a €5–7 million demand in one 2025 Paris case; the Ledger co-founder abduction that January followed the same logic.
The American version is organised and digital. A US racketeering indictment charged twelve additional defendants over more than $263 million, including a July 2024 New Mexico home invasion where one man broke in for a hardware wallet while another tracked the victim’s location through iCloud.
Defences That Change the Outcome
Decide your compromise wallet before you need it
A decoy wallet holds a plausible but modest balance on a separate seed, with its own app and short history. Under coercion it buys you an ending: the attacker gets something, the violence stops, the bulk stays out of reach. It only works if you have rehearsed the unlock and the “this is everything” delivery calmly, before you are tested.
Put a passphrase and a second signature in the way
A BIP-39 passphrase creates a different wallet behind the same twelve or twenty-four words, so a seed phrase handed over under duress reveals nothing. Multisig goes further: 2-of-3 with one key held off-site means coercion requires several people in several places at once.
Separate your identity from your holdings
Assume your name will end up on a list. Never pair it with wallet addresses, do not publish balances or gains, use a fresh address per payment, and keep ENS names away from your professional identity. Ask your exchange and tax software what they hold.
Make the house boring and brief the family
Alarm, cameras, a bolted-down safe for metal backups and idle hardware, and no opening the door to unannounced visitors. Brief the family, agree a code word for a genuine emergency, and never keep the full key set in one building.
If It Happens
Comply first. No balance is worth a life, and resisting escalates the violence. Send what is demanded, then get medical help, call police and report the receiving addresses, messaging account, vehicle details and the exact time. Contact your exchange’s fraud team — a deposit routed to a hosted wallet is the one case where a freeze is still possible. Do not post the amount. Afterwards treat every key and session on that device as burned, move remaining funds to a wallet created elsewhere, and watch for a second visit.
Frequently Asked Questions
What is a wrench attack?
A wrench attack is a robbery, kidnapping or hostage situation in which physical violence or the threat of it is used to force a crypto holder to transfer funds. The attacker does not break encryption or steal a key remotely; the victim unlocks the wallet and sends the money under duress.
Does a hardware wallet protect against a wrench attack?
No. A hardware wallet stops remote attackers who only have a copy of your seed phrase or a malicious website. In a physical confrontation the attacker needs you to approve the transaction, so the device becomes the tool rather than the defence.
Does a decoy wallet actually help?
It can, if it is funded with a believable amount, uses a separate seed phrase and its own app, and you have rehearsed handing it over calmly. It works by giving the attacker an exit — a decoy that looks empty or improvised usually makes the violence worse.
Are wrench attacks increasing in 2026?
Yes. Chainalysis recorded roughly $30 million stolen in the first half of 2026 against a record $58 million for all of 2025, with 46 documented incidents by mid-year versus 40 a year earlier. CertiK counted 52 confirmed H1 2026 incidents, up 33%, and home invasions rose from one case to 20.
What should I do if someone threatens me for my crypto?
Comply. Transfer what is demanded rather than resist armed attackers, then contact police and your exchange’s fraud team immediately — a deposit into a hosted wallet is the only scenario where a freeze may still be possible. Afterwards move remaining funds to a new wallet created on a different device.
Find out what your infrastructure is already leaking
Target lists are built from exposed data. RootCrak’s autonomous scanner probes your domains, servers, APIs and Web3 endpoints from the outside — surfacing exposed services, leaked credentials and misconfigurations before someone uses them against you.
Get a Free Security Scan