Crypto home invasions top wrench attacks in H1 2026

Crypto home invasions surged to 20 incidents in the first half of 2026, making up roughly 41% of all verified wrench attacks and pushing total recorded losses to $124.1 million – a 33.3% rise in incidents and an 11.8‑fold jump in exposure year‑on‑year【2】.

Surge in physical coercion

CertiK’s Intel3D report shows a sharp rise in “wrench” attacks – crimes that use physical force to compel victims to hand over crypto. The total number of verified incidents grew from 39 in H1 2025 to 52 in H1 2026, while the financial exposure leapt from $10.5 million to $124.1 million, raising the average loss per case from $270,000 to $2.39 million【4】. Home invasions, previously a rarity with a single case in H1 2025, exploded to 20 incidents, now accounting for the largest share of attacks. Europe remains the hotspot, contributing 39 of the 52 global cases, and France alone is responsible for 33 incidents – 63.5% of the worldwide total【2】.

French response and underlying drivers

French Interior Minister Laurent Nuñez reported 77 crypto‑linked kidnappings, extortions or attempted extortions in H1 2026, up from 45 for the entire 2025, highlighting a methodological gap between government counts and CertiK’s verification process【1】【3】. The French government has rolled out a dedicated prevention platform and a rapid‑alert system that has attracted 724 sign‑ups and led to roughly 200 arrests, including one arrest within eight hours of a victim’s emergency call【3】.

CertiK attributes the concentration in France to extensive data breaches that exposed identities, home addresses and perceived crypto wealth, rather than to Bitcoin price movements. Two major breaches – the France Travail compromise and the ANTS portal leak – fed personal data to criminals, enabling them to locate high‑value targets and bypass on‑chain security controls【4】. The firm recommends multisignature, multiparty computation, withdrawal delays and geographically separated signers to mitigate the risk that a single coerced individual can empty an account【1】.

What to watch

• Arrest statistics – monitor French law‑enforcement updates for further arrests or changes in the rapid‑alert system’s usage.
• Data breach disclosures – any new large‑scale leaks of personal data in Europe could fuel additional targeting of crypto holders.
• Home‑invasion trends – watch for subsequent quarterly reports from CertiK for shifts in the proportion of home invasions versus other coercion methods.

The surge in physical coercion attacks underscores a growing gap between traditional on‑chain security measures and the real‑world threat landscape. As data exposure proves the primary catalyst, the effectiveness of self‑custody advice will increasingly depend on integrating robust off‑chain privacy and operational safeguards.