2026 Wrench Attacks Spike to $101M

Violent wrench attacks against wealthy crypto holders have spiked in the first four months of 2026, with more than $101 million stolen.

Europe leads the way with this type of theft, with France the epicenter of these attacks. Of the 34 wrench attacks documented by crypto security firm CertiK so far this year, 28 were in Europe and 24 in France.

If the trend continues, CertiK said the total could reach 130 incidents this year, compared to 81 with a total of $52 million stolen in 2025.

Wrench attacks generally consist of home invasions or kidnappings in which violence or the threat of violence is used to force victims to turn over their crypto holdings, which can be almost immediately moved into privacy protocols and rendered untraceable. Notably, in 2025, David Balland, co-founder of hardware wallet maker Ledger, was kidnapped, tortured, and had a finger cut off in a French wrench attack.

France is a hotspot

Even CertiK’s 24 French wrench attack count is incomplete. The French Ministry of the Interior has publicly said there have been 47 incidents linked to physical attacks in France since the start of the year.

French prosecutors have announced the arrest of 88 suspects in wrench attacks. In most cases, the attackers are not part of a gang. Instead, they “are recruited via messaging apps such as Telegram or Snapchat for a few thousand dollars,” CertiK said. “They don’t know each other and are complete amateurs… The orchestrators are very often located outside the target country. They purchase data lists, commission coordinators, and receive funds before laundering them.” A growing number of the hired gang members are minors.

It’s noteworthy that more than half of the French attacks were on a family member of the targeted crypto owner rather than the person themself. That’s not limited to France. The highest profile wrench attack of 2026 was the U.S. kidnapping of the mother of “Today Show” co-host Savannah Guthrie for a $6 million ransom. She is still missing. Reports indicate the ransom was never paid after the kidnappers did not provide proof of life.

“The structural takeaway is clear,” CertiK said. “As the security of protocols and wallets tends to improve, the threat migrates toward the human link. As long as crypto-asset holdings remain associated with identifiable financial data, physical coercion will remain the economically most rational attack path.”