Loading story…
Violent "wrench" attacks targeting cryptocurrency holders are increasing, with criminals using kidnapping, home invasions, and threats against family members or associates to force victims to surrender wallet access or transfer digital assets. According to reporting citing CertiK, 52 such attacks were identified globally in the first half of 2026, up from 39 in the same period of 2025, while associated losses rose to $124 million from $10.5 million. Researchers and investigators say the attacks increasingly exploit the realities of self-custody, where victims can be coerced into authorizing irreversible transfers without any intermediary able to freeze or reverse the theft.
U.S. prosecutors highlighted the trend in a Minnesota case in which brothers Isiah Angelo Garcia and Raymond Christian Garcia pleaded guilty after an armed 2025 home invasion that stole more than $8 million in cryptocurrency. Court documents said the pair traveled from Texas, held a family at gunpoint for more than eight hours, forced the primary victim to provide access to crypto accounts and storage devices, and fled before being identified through evidence left at the scene and arrested near Houston. The case has been cited alongside other incidents, including attacks in France and Connecticut, as part of a broader rise in crypto-related violent crime aimed not only at asset holders but also at spouses, children, employees, drivers, assistants, and friends.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The Record reported that CertiK identified 52 wrench attacks worldwide in the first half of 2026, up from 39 in the same period of 2025, with reported exposure reaching $124 million. The article also noted that attackers increasingly target relatives and associates of crypto holders as proxy victims.
After the victim’s son called 911, the suspects fled the Minnesota scene, but investigators used items left behind to identify them and locate them near Houston, Texas, where they were arrested. The source does not provide a specific arrest date.
The U.S. Attorney’s Office for the District of Minnesota announced that Isiah Angelo Garcia and Raymond Christian Garcia pleaded guilty to one count of Interference with Commerce by Robbery for their roles in the 2025 armed cryptocurrency kidnapping. They admitted using firearms and agreed to pay more than $8 million in restitution.
On September 19, 2025, brothers Isiah Angelo Garcia and Raymond Christian Garcia carried out an armed home invasion and kidnapping in Grant, Minnesota, restraining a family for more than eight hours and forcing access to cryptocurrency accounts and storage devices. More than $8 million in cryptocurrency was stolen during the attack.
TRM Labs published analysis describing the rise of wrench attacks and crypto-related violent crime. The reference synopsis does not provide dated underlying incident details beyond the publication itself.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcejustice.gov
Open sourcetrmlabs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals in Europe are increasingly resorting to physical violence, including kidnappings and assaults, to extort cryptocurrency and privileged access from victims. According to CrowdStrike's European Threat Landscape Report and corroborated by multiple security researchers, at least 17 to 18 such incidents have been reported since early 2025, with France experiencing the majority of cases. Notable attacks include the January kidnapping and mutilation of Ledger co-founder David Balland and his wife, as well as a series of violent robberies targeting individuals known to possess significant cryptocurrency assets. Law enforcement has made several arrests, including the alleged ringleader in Morocco, but the threat persists and is evolving. Experts note that these attacks often combine cyber and physical tactics, with criminals using cyberattacks as distractions or to identify high-value targets before launching in-person assaults. The rise of "violence as a service" is forcing organizations and individuals, especially those in the cryptocurrency sector, to reevaluate their security strategies and consider physical protection alongside traditional cyber defenses. Security consultants warn that playbooks for incident response must now account for the possibility of real-world violence accompanying digital threats, marking a significant escalation in the risk landscape for privileged users and executives in Europe.
Jun 29, 2026
South Korean police arrested two suspects over the alleged embezzlement of **22 BTC (~$1.5M)** that had been held in police custody after a virtual asset company turned over a cold wallet during a 2021 hacking investigation. Reporting indicates required procedures to move seized crypto into a police-controlled cold wallet and vault were not followed; instead, the original third party retained control elements and later allegedly provided a **mnemonic seed phrase** to a hacker as part of a purported “loan” arrangement, enabling the attacker to recover the wallet and transfer the funds without police detection. The theft was reportedly uncovered during a National Police Agency audit triggered by a separate January 2026 incident in which **320 BTC** went missing from the Gwangju District Prosecutors’ Office. Separately, the U.S. Department of Justice announced the seizure of **$61 million in USDT (Tether)** tied to **“pig butchering”** cryptocurrency investment scams, stating the funds were traced to addresses used to launder proceeds stolen from victims. The DoJ described typical scam mechanics involving social engineering via dating/social messaging apps, coercion of trafficked workers in Southeast Asia–based scam compounds, and fraudulent investment platforms that display fabricated returns and impose additional “fees” when victims attempt withdrawals, with law enforcement emphasizing cross-border tracing and disruption of laundering infrastructure.
Jun 29, 2026
Law enforcement agencies in multiple countries have made significant progress in prosecuting individuals and groups involved in large-scale cryptocurrency-related cybercrimes. In the United States, a California man pleaded guilty to laundering at least $25 million as part of a group that stole $230 million in cryptocurrency through social engineering and account takeovers. The group, composed of young adults from several states and abroad, used various tactics to compromise victims' crypto accounts and launder the proceeds, with several members facing charges including wire fraud, racketeering, and money laundering. In the United Kingdom, prosecutors secured a civil recovery order to seize over £4.11 million ($5.39 million) in crypto assets from Joseph James O'Connor, who was convicted for his role in the 2020 Twitter mega-hack. O'Connor and his associates used SIM-swapping and social engineering to hijack high-profile Twitter accounts, soliciting Bitcoin from followers and amassing illicit gains. These actions demonstrate the increasing effectiveness of international law enforcement in tracing, prosecuting, and recovering assets from cybercriminals who exploit cryptocurrency for large-scale fraud and theft.
Jul 12, 2026