Chainalysis's analytical department has recorded a worrying trend: in the first half of 2026, criminals using physical violence stole more than $30 million from cryptocurrency holders. At the same time, France unexpectedly became the world leader in the number of such incidents, pointing to systemic problems in the industry's security.
This refers to so-called "wrench attacks" — when attackers kidnap people, break into homes, or take hostages to forcibly gain access to digital assets. For criminals, cryptocurrency holders are an ideal target: transfers are instantaneous, irreversible, and require no bank approval.
Notably, the number of successful attacks has been declining for the third consecutive year. By the end of June 2026, ransoms were obtained in only 26% of cases (12 out of 46), compared to 49% (47 out of 95) a year earlier and 67% (32 out of 48) in 2024. However, the total number of attempts is rising, and if the trend continues, the annual damage could exceed last year's $58 million and become the highest ever recorded.
The $30 million figure reflects only those episodes where victims actually parted with their funds. If unsuccessful attempts are included — blocked transfers, recovered assets, and foiled ransoms — the real scale looks different: approximately $316 million in 2024, $180 million in 2025, and already $107 million in the incomplete 2026. The gap between the estimates shows how often criminals now fail.
France: From Targeted Strikes to an Avalanche of Attacks
Since 2023, the geography of incidents has covered France, the United States, Brazil, and Thailand, but it is the French cases that stand out. Until 2025, only isolated cases were recorded in the country. Then the number surged to 19 in a year, and by mid-2026 it reached 30 publicly known episodes. The real scale is significantly larger: at the end of June, Interior Minister Laurent Nuñez reported that authorities had documented over 75 incidents related to cryptocurrencies and announced enhanced protection for industry participants, including a rapid alert system for at-risk groups.
The surge is directly linked to a data leak. In 2024, a Paris tax office employee was suspected of stealing and selling files on wealthy cryptocurrency holders — including names, addresses, phone numbers, asset sizes, and tax histories. According to available information, these materials were purchased by criminal intermediaries, after which attacks "came in an avalanche." The frequency of attacks rose from 1.9 incidents per month in 2025 to approximately 4.6 in the first half of 2026.
Tactics have also changed. While attackers previously targeted almost exclusively the asset owner themselves, by early 2026 relatives and acquaintances were involved in approximately 25–30% of cases, and in France — in more than 40%. Victims are almost everywhere local residents: in Sweden their share reached 100%, in France — 93%, in Brazil — 82%, in the United States — 77%. The exception is the Netherlands with 67% foreigners, but only three incidents were recorded there, so the statistics are unreliable.
French investigators link the wave to organized crime, so the cases were transferred to JUNALCO, a specialized prosecution office. By mid-2026, police had detained about 200 people, 88 of whom were charged, and 75 suspects were sent to pretrial detention. In parallel, more than ten investigations are ongoing.
Expert opinion: This situation is a wake-up call for the entire industry. The tax data leak showed that even seemingly the most protected areas can become a source of threat for asset holders. Investors should review their security protocols, especially in countries with growing criminal activity. Storing large sums on hot wallets and publicly displaying wealth are becoming not just carelessness but a direct invitation to attack.