Home invasions became most common crypto wrench attack in H1 2026: CertiK

Home invasions became the most common form of crypto wrench attacks during the first half of 2026, rising to 20 publicly reported incidents from just one a year earlier, according to blockchain security firm CertiK. 

On Thursday, CertiK said it verified 52 wrench attacks worldwide in the first half of 2026, up 33.3% from 39 incidents during the same period in 2025. Kidnappings rose to 16 from 12, while robberies declined from five incidents to one. 

CertiK said the recorded financial exposure linked to the attacks reached about $124.1 million, up from $10.5 million a year earlier. The figure is not limited to confirmed thefts and may include ransom demands, victim transfers, frozen or recovered assets and failed ransom demands. 

The increase in home invasions suggests criminals are increasingly bypassing digital safeguards by physically coercing crypto holders and their families.

Attack type year-on-year, H1 2025 vs. H1 2026. Source: CertiK

France remains center of crypto wrench attacks 

Europe accounted for 39 of the 52 verified incidents, while France alone accounted for 33, or nearly two-thirds of the global total. CertiK said it used a narrower methodology than French authorities, counting only publicly reported incidents it could independently verify. 

Share of wrench attacks by region. Source: CertiK

On July 2, French Interior Minister Laurent Nuñez said authorities had recorded 77 crypto-linked kidnappings, extortion cases or attempted extortion cases during the first half of 2026, up from 45 in the entire year of 2025.

CertiK said the concentration may reflect France’s more visible crypto ecosystem, with data breaches and information connecting identities and home addresses with perceived crypto wealth.

Related: US seeks forfeiture of $25M in crypto tied to romance, investment scams

In response, French authorities launched a dedicated prevention platform and a rapid-alert system for crypto holders and professionals. Nuñez said that emergency measures have resulted in 200 arrests. 

CertiK said the rise in physical coercion challenges conventional self-custody advice. The company recommended multisignature or multiparty computation arrangements, withdrawal delays, spending limits and geographically separated signers so one threatened person cannot immediately release all available assets.

Magazine: Inside the ‘fake police raid’ that forced a $1M Bitcoin transfer