CertiK recorded 52 wrench attacks in H1 2026, a 33.3% increase. Financial exposure jumped 1,079%, from US$10.5 million to US$124.2 million. France accounted for 33 of the 52 global cases.

Between January and June 2026, 52 verified wrench attacks were recorded worldwide, a 33.3% increase compared to the 39 cases in the same period of 2025. The most alarming statistic is not the number of incidents, but the amount involved: the financial exposure jumped from US$10.5 million to US$124.2 million, a 1,079% increase in one year.

The figures are part of the CertiK Intel3D Wrench Attacks H1 2026 study , which analyzes attacks in which criminals use violence, intimidation, kidnapping, or threats to force victims to transfer crypto assets, unlock wallets, or hand over login credentials.

What are wrench attacks?

The term refers to the simplest possible tool. While hackers exploit vulnerabilities in code, wrench attackers exploit human vulnerabilities : physical threats, kidnappings, and home invasions to force crypto transfers.

The model is brutally straightforward. The victim is identified, approached, and coerced into transferring assets, revealing seeds, or unlocking wallets under physical duress. Unlike hacks, which can be reversed or traced in a timely manner, transfers made under coercion are often irreversible and difficult to prove in court.

What changed in 2026 is the scale and intelligence behind the attacks. The average exposure per incident jumped from approximately US$270,000 to US$2.39 million, indicating that criminals are selecting targets with greater wealth and planning operations more carefully.

Europe at the center and France as the epicenter.

Europe accounted for 75% of the incidents, with 39 of the 52 cases recorded in the semester. Within Europe, France was the most affected country: 33 occurrences , making it the main focus of wrench attacks in the world.

The CertiK report indicates that France is home to a large and visible cryptocurrency ecosystem, with exchanges, founders, investors, service providers, and frequent industry events.

Public visibility combined with a series of data breaches from private and public organizations has created a favorable environment: criminals with access to customer data from exchanges or wallets know where to look for victims.

Home invasions have become the main vector of attack , increasing from just one case in H1 2025 to 20 occurrences in H1 2026.

In Brazil, the trend was reversed: from five incidents in H1 2025 to one in H1 2026, the only case recorded in all of South America during that period. The kidnapping of the influencer in Ribeirão Preto in July 2026, which resulted in the theft of R$750,000 in crypto after criminals impersonated police officers, was not included in this report because it occurred outside the analyzed period.

The convergence between digital and physical risk.

The most relevant finding of the study is not the number of attacks. It's the method behind them.

The wrench attacks of 2026 don't start with a sledgehammer. They start with research. Criminals use data breaches, social media, public records, exchange customer information, on-chain activity, and other sources to identify high-net-worth victims before any physical approach.

“We are seeing a convergence between digital and physical risks. This requires companies to treat infrastructure security, access governance, and data protection as parts of the same strategy,” said Jason Jiang, Chief Business Officer of CertiK.

In practice, this means that a data breach at an exchange is not just a privacy issue. It's a map for criminals to identify who has assets in crypto, where they live, and the approximate volume of their assets.

"Companies must combine code audits, infrastructure protection, access governance, risk monitoring, and data protection policies to reduce opportunities that can be exploited both in the digital environment and outside of it," Jiang added.

What crypto investors and executives should do.

CertiK lists practices that reduce both digital and physical exposure: limiting the public visibility of crypto assets , using wallets with multi-layered security settings, not disclosing asset volumes at public events or on social media, and ensuring that personal data is not exposed in public records associated with crypto holdings.

For companies within the ecosystem, the recommendation goes beyond technical security. Protecting customer and employee data, including physical addresses and privileged access information, is now part of operational risk management, not just regulatory compliance.