Loading story…
Criminals are increasingly using kidnappings, home invasions, and hostage-style coercion to force cryptocurrency holders to transfer digital assets, pushing so-called wrench attacks to record levels. Chainalysis reported that successful violent crypto thefts reached $58 million in 2025 and had already surpassed $30 million in the first half of 2026; when attempted extractions are included, losses rise to about $107 million. Home invasions now account for 37% of incidents, up from 26% in 2023, while kidnappings remain a persistent tactic.
France has emerged as the most significant hotspot, with researchers linking the spike in part to alleged breaches involving French tax records and the Waltio crypto tax-reporting platform that may have exposed wealthy crypto holders to targeting. The victims are most often local residents rather than tourists, and attackers are increasingly targeting family members for leverage. On-chain analysis indicates the threat spans both opportunistic criminals who cash out directly through centralized exchanges and more organized groups that rely on laundering services and broader illicit financial networks.
Track how attackers are adapting to this technology.
9 events from the most recent confirmed update back to the earliest known activity.
In late June 2026, French Interior Minister Laurent Nuñez said authorities had documented over 70 crypto-related violent incidents. He also announced plans to strengthen protections for people in the crypto sector, including a rapid identification and alert system for at-risk figures.
By mid-2026, the French crackdown on crypto-related violent attacks had resulted in around 200 arrests, 88 indictments, 75 suspects in pretrial detention, and more than a dozen investigations. Authorities were treating the wave as organized crime and prosecuting cases through JUNALCO.
Successful violent crypto thefts had already exceeded $30 million by mid-2026, while attempted and successful extractions together reached about $107 million. Home invasions also rose to 37% of incidents through mid-2026, up from 26% in 2023.
France had already logged 30 publicly known crypto-related violent incidents through mid-2026, with attacks spreading beyond Greater Paris to cities including Strasbourg, Marseille, Grenoble, Toulouse, and Nantes. The report says France experienced roughly 48 attacks above its historical norm by that point.
By early 2026, incidents targeting family members or acquaintances accounted for approximately 25% to 30% of cases, up from near zero in 2021. In France, over 40% of incidents targeted a relation of the crypto holder rather than the holder directly.
The crypto tax-reporting platform Waltio disclosed a separate breach affecting about 50,000 users in January 2026. The report says this may have further expanded the pool of identifiable French crypto targets.
France, which had seen only a handful of known crypto-related violent incidents before 2025, recorded 19 known incidents during 2025. The report describes this as the start of a sharp national surge.
Successful violent cryptocurrency thefts totaled $58 million in 2025, the highest annual amount on record. Chainalysis also reported 47 successful payments out of 95 incidents that year, for a 49% success rate.
In 2024, a French tax official in the Paris area was alleged to have stolen and sold dossiers on high-net-worth cryptocurrency holders, including names, addresses, holdings, phone numbers, and tax records. The report identifies this alleged breach as the likeliest driver of France's later surge in wrench attacks.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Violent **"wrench" attacks** targeting cryptocurrency holders are increasing, with criminals using kidnapping, home invasions, and threats against family members or associates to force victims to surrender wallet access or transfer digital assets. According to reporting citing CertiK, **52 such attacks** were identified globally in the first half of 2026, up from **39** in the same period of 2025, while associated losses rose to **$124 million** from **$10.5 million**. Researchers and investigators say the attacks increasingly exploit the realities of **self-custody**, where victims can be coerced into authorizing irreversible transfers without any intermediary able to freeze or reverse the theft. U.S. prosecutors highlighted the trend in a Minnesota case in which brothers **Isiah Angelo Garcia** and **Raymond Christian Garcia** pleaded guilty after an armed 2025 home invasion that stole more than **$8 million** in cryptocurrency. Court documents said the pair traveled from Texas, held a family at gunpoint for more than eight hours, forced the primary victim to provide access to crypto accounts and storage devices, and fled before being identified through evidence left at the scene and arrested near Houston. The case has been cited alongside other incidents, including attacks in France and Connecticut, as part of a broader rise in crypto-related violent crime aimed not only at asset holders but also at spouses, children, employees, drivers, assistants, and friends.
Jul 24, 2026
Cybercriminals in Europe are increasingly resorting to physical violence, including kidnappings and assaults, to extort cryptocurrency and privileged access from victims. According to CrowdStrike's European Threat Landscape Report and corroborated by multiple security researchers, at least 17 to 18 such incidents have been reported since early 2025, with France experiencing the majority of cases. Notable attacks include the January kidnapping and mutilation of Ledger co-founder David Balland and his wife, as well as a series of violent robberies targeting individuals known to possess significant cryptocurrency assets. Law enforcement has made several arrests, including the alleged ringleader in Morocco, but the threat persists and is evolving. Experts note that these attacks often combine cyber and physical tactics, with criminals using cyberattacks as distractions or to identify high-value targets before launching in-person assaults. The rise of "violence as a service" is forcing organizations and individuals, especially those in the cryptocurrency sector, to reevaluate their security strategies and consider physical protection alongside traditional cyber defenses. Security consultants warn that playbooks for incident response must now account for the possibility of real-world violence accompanying digital threats, marking a significant escalation in the risk landscape for privileged users and executives in Europe.
Jun 29, 2026
Illicit actors continue to hold and move significant amounts of cryptocurrency, with on-chain balances linked to criminal activity now exceeding $75 billion. According to blockchain analytics, nearly $15 billion is directly held by entities identified as illicit, with stolen funds representing the largest share of these holdings. Downstream wallets, which have received more than 10% of their inflows from illicit sources, collectively hold over $60 billion, indicating that the reach of criminal proceeds extends far beyond the original perpetrators. Darknet market administrators and vendors alone control over $40 billion in on-chain value, highlighting the scale of underground digital economies. Bitcoin remains the dominant cryptocurrency among illicit balances, accounting for 75% of the total, though stablecoins and ether have seen substantial growth in criminal usage. The concentration of these funds is typically high, with a small number of wallets holding the majority of assets. Illicit actors are adapting their laundering techniques, increasingly using more cashout addresses for shorter periods to evade detection. Direct transfers from illicit entities to exchanges have dropped significantly, from about 40% of quarterly value in 2021–2022 to just 15% in Q2 2025, reflecting changes in both enforcement and criminal tactics. Law enforcement agencies, particularly in the United States, are responding by establishing strategic reserves and stockpiles of seized digital assets, and have already confiscated over $12.6 billion in illicit funds with the help of blockchain analytics firms. The timing of enforcement actions varies, with market-based illicit services tending to operate longer before being disrupted. Once illicit entities stop receiving funds, the speed at which they empty their wallets depends on the type of cryptocurrency held. Meanwhile, specific high-profile incidents continue to occur, such as the $21 million theft from SBI Crypto, a subsidiary of Japan's SBI Group. In this case, hackers stole a variety of cryptocurrencies, including bitcoin, ethereum, litecoin, dogecoin, and bitcoin cash, and laundered the proceeds through Tornado Cash, a mixing service favored by cybercriminals. Investigators noted that the tactics and laundering patterns in the SBI Crypto heist closely resembled those used by North Korean hacking groups, suggesting a possible link to Pyongyang's ongoing campaign to finance illicit activities through digital asset theft. The SBI Crypto incident is part of a broader trend, with North Korean threat actors reportedly stealing a record $2 billion in cryptocurrency so far this year. These developments underscore the persistent threat posed by sophisticated cybercriminals and nation-state actors in the cryptocurrency ecosystem, as well as the evolving strategies of both criminals and law enforcement in the battle over digital assets. The growing landscape of seizable crypto assets presents both a challenge and an opportunity for authorities seeking to disrupt illicit financial flows. As criminals refine their methods, the need for advanced analytics and coordinated international enforcement becomes increasingly critical. The ongoing arms race between cybercriminals and law enforcement is likely to shape the future of digital asset security and regulation.
Jun 29, 2026