Market analysis reveals a troubling trend: in the first half of 2026, criminals stole over $30 million from digital asset holders using physical violence. France has become the epicenter of this crisis, showing a record number of such incidents.
This refers to so-called "wrench attacks" — kidnappings, home invasions, and hostage-taking aimed at forcing cryptocurrency transfers. Criminals have realized that digital asset holders are an ideal target: their funds can be converted instantly, and transactions are irreversible.
The paradox of statistics: less success, more attempts
If the current pace continues, 2026 will break all anti-records, exceeding last year's $58 million in losses. However, the $30 million figure only reflects cases where the victim actually transferred their funds. The real picture is much darker: including failed attempts, blocked transfers, and recovered assets, the total amount of attacks reaches $316 million in 2024, $180 million in 2025, and $107 million in the incomplete 2026. The gap between these estimates shows how often criminals now fail.
The share of successful attacks has been declining for the third consecutive year. By the end of June 2026, ransoms were obtained in only 26% of cases — 12 episodes out of 46. For comparison: a year earlier, the figure was 49% (47 out of 95), and in 2024 — 67% (32 out of 48).
France: from targeted strikes to mass terror
The reason for this decline lies in events in France. A tax authority data leak sharply expanded the pool of potential victims, turning attacks from targeted operations into a chaotic stream. Previously, criminals acted selectively, relying on gathered intelligence about a specific person.
Tactics have also changed. Kidnappings remain the most popular form, followed by home invasions and hostage-taking. The share of home break-ins rose from 14% in 2025 to 37% by mid-2026, while kidnappings increased from 39% to 52% over the same period.
France has become the main risk hotspot. Before 2025, the country recorded isolated cases. Then the number grew to 19 per year, and by mid-2026 reached 30 publicly known episodes. The real scale is significantly larger: at the end of June, Interior Minister Laurent Nuñez reported more than 75 documented incidents related to cryptocurrencies. Authorities have already announced enhanced protection for industry participants, including a rapid alert system for at-risk groups.
The geography of attacks has expanded beyond the capital region. In 2026, episodes were recorded in Strasbourg, Marseille, Grenoble, Toulouse, and Nantes. Even small communes, where nothing like this had happened before, were affected.
The root of evil: tax data leak
The surge is directly linked to the data leak. In 2024, a Paris tax office employee was suspected of stealing and selling files on wealthy cryptocurrency holders — with names, addresses, phone numbers, asset sizes, and tax history. These materials were purchased by criminal intermediaries, and attacks "snowballed." The frequency of attacks rose from 1.9 incidents per month in 2025 to approximately 4.6 in the first half of 2026.
Criminals are divided into three groups by skill level. Some immediately transfer assets to major exchanges without trying to hide their tracks — such cases are solved fastest. Others use decentralized platforms, cross-chain bridges, and MEV bots to avoid identity verification. A third group works with criminal networks: in one case, money passed through a fast exchange service and an over-the-counter platform that had previously served drug cartels and money laundering schemes.
My expert take: The situation in France is a wake-up call for the entire industry. The tax data leak showed how vulnerable traditional financial infrastructure is in the face of crypto crime. Investors should reconsider their security protocols: use multi-signature wallets, avoid publicly linking assets to identity, and consider services from professional custodians with physical protection. The market must adapt to new threats faster than regulators do.