Crypto Wrench Attacks Steal Over $30 Million in 2026

Violent attacks targeting cryptocurrency holders are rising sharply, and criminals are turning to kidnappings, home invasions and hostage situations to steal digital assets, according to a new Chainalysis report.

Chainalysis estimates that criminals have successfully stolen more than $30 million through violent crypto attacks so far in 2026. If the current pace continues, the year could surpass 2025, when approximately $58 million was successfully extracted from victims.

Annual Crypto Value in Violent Attacks by Outcome (Source: Chainalysis)

The figures become much larger when unsuccessful attempts are included. Chainalysis estimates that attempted extractions, including ransom demands, blocked transfers and funds later frozen or recovered, totaled roughly $316 million in 2024, $180 million in 2025 and $107 million so far this year.

Despite the rise in incidents, attackers are becoming less successful. Only around 26% of documented violent theft attempts through late June 2026 resulted in payments, compared with 49% in 2025 and 67% in 2024.

France is the biggest hotspot for so-called crypto “wrench attacks.” The country recorded 19 publicly known incidents in 2025 and another 30 through mid-2026. However, French Interior Minister Laurent Nuñez said authorities documented more than 70 crypto-related violent incidents by late June.

(Source: Chainalysis)

Interestingly, Chainalysis said a major data breach may have contributed to the surge.

A French tax official was allegedly involved in stealing and selling information about wealthy crypto holders, including names, addresses, phone numbers, holdings and tax records. Separately, crypto tax-reporting company Waltio disclosed a breach that involved around 50,000 users in January.

Attacks in France increased from approximately 1.9 per month in 2025 to around 4.6 per month during the first half of 2026.

French authorities responded with a major organized-crime crackdown that reportedly resulted in around 200 arrests, 88 indictments and 75 suspects being placed in pretrial detention by mid-year.

Kidnappings are the most common form of violent crypto attack, but home invasions are becoming increasingly prevalent. Home invasions accounted for just 14% of attacks in 2025 but increased to 37% through mid-2026. Kidnappings represented roughly 52% of documented incidents this year.

(Source: Chainalysis)

Attackers are also increasingly targeting relatives of crypto holders. By early 2026, family members or acquaintances were involved in roughly 25% to 30% of cases, compared with almost none in 2021.

In France, more than 40% of incidents reportedly targeted someone connected to the crypto holder rather than the holder directly.

Chainalysis identified three broad categories of attackers based on how stolen funds are moved.

Less sophisticated criminals often transfer stolen crypto directly to centralized exchanges, which creates opportunities for exchanges and law enforcement to freeze funds and identify suspects.

More experienced groups use decentralized exchanges, bridges and other DeFi services to obscure transaction trails.

The most sophisticated attackers are connected to wider criminal networks and professional laundering operations. Chainalysis said some stolen funds have ultimately interacted with services associated with organized crime, money laundering networks and other illicit actors.

Overall, crypto crime is now moving beyond purely digital attacks. As cryptocurrency ownership grows, protecting identifying information and maintaining strong operational security may become just as important as protecting private keys.