Chainalysis: Crypto “wrench” attacks top $30M stolen in 2026

Physical theft targeting crypto holders is escalating, according to a new Chainalysis report that tracks “wrench attacks” — kidnappings, home invasions, and hostage scenarios designed to force victims to hand over digital assets. In the first half of this year, criminals stole more than $30 million through these violent robberies, putting 2026 on course to exceed the $58 million record reported for 2025.

Chainalysis said it documented 46 violent crypto-related incidents globally through late June, up from 40 during the same period in 2025. The report highlights a key shift for crypto security: the risk is no longer limited to custody and account access, but increasingly extends to victims’ homes, families, and personal safety.

Key takeaways

• $30M+ was reportedly stolen in wrench attacks in the first half of 2026, suggesting the year could surpass $58M stolen in all of 2025.
• 46 incidents were recorded worldwide through late June, up from 40 in the same period of 2025.
• Payment outcomes remain limited: only 12 of 46 attacks led to a payment, for a 26% success rate.
• Success appears down: the reported payment rate fell from 49% in 2025.
• France is a hotspot: the report lists 30 public incidents by midyear, versus 19 across all of 2025.

A rise in violence, even as payment rates fall

Chainalysis’ figures point to wrench attacks becoming more frequent, even though the percentage of cases that result in payments has declined. In its analysis, the firm found that just 12 of the 46 documented incidents through late June ended in attackers receiving payment, translating to a 26% success rate.

That rate is lower than in 2025, when Chainalysis reported a 49% success rate for similar incidents. The discrepancy matters for investors and users because it implies criminals may be scaling up the number of attempts to offset lower yields, increasing aggregate harm even if individual attacks are less likely to pay out.

At the same time, Chainalysis cautioned that the real scale is likely understated. The firm noted that many attacks may go unreported, meaning the measured success rate could be distorted by incomplete visibility into outcomes.

The report also describes a troubling operating model: “tradecraft tends to be amateur at the point of violence, but professional at both ends.” In other words, some attackers executing the physical threat appear less sophisticated, while the selection and planning of targets may be more systematic — often involving victims identified through data leaks, social media, or insider information.

France’s surge and the role of leaked or misused data

While wrench attacks are global, the report indicates a particularly sharp concentration in France. Chainalysis said France logged 30 publicly known incidents by midyear, compared with 19 throughout 2025. Crucially, Chainalysis also pointed to the possibility that the visible number is a fraction of the true total: French authorities have reportedly counted more than 70 incidents.

In July, French Interior Minister Laurent Nuñez put the first-half figure at 77 kidnappings, extortions, or attempted extortions — up from 45 for all of 2025. (Earlier coverage from Cointelegraph noted the government’s response alongside those figures.) Spain arrests suspect in 2025 kidnapping of Ledger co-founder is unrelated to the French count, but it underscores how reported incidents are being closely followed across jurisdictions.

The French government response, according to the report, includes a rapid-alert and protection system, with promises of expanded intelligence-sharing and coordination with the crypto industry. The implied investor takeaway is that regulators and law enforcement are treating physical targeting as a broader security issue, not merely an isolated criminal pattern.

Chainalysis also identified what it called the likeliest driver of the surge: alleged misuse of French tax records. The report describes an allegation that a French tax official accessed and sold information about crypto investors to criminals. In addition, it reports a separate breach at crypto tax-reporting company Waltio that reportedly exposed data for about 50,000 users.

For crypto holders, these details emphasize why personal data hygiene and source integrity are increasingly relevant to safety. If criminals can identify likely crypto owners with prior knowledge, the attack risk can rise regardless of whether a victim’s coins are securely held in a formal wallet setup.

How stolen funds move after the violence

The Chainalysis report also examined what happens after the physical threat — specifically, how attackers convert coercion into onchain value. The firm said tactics varied across cases.

In some incidents, attackers allegedly sent stolen funds directly to centralized exchanges. Other attackers reportedly used a sequence of tools and venues, including bridges, decentralized exchanges, and laundering services. Chainalysis noted that the most advanced cases showed links to broader criminal networks, suggesting that violence is only one part of an ecosystem that may include professional financial facilitation.

That multi-stage behavior is important for readers trying to understand both risk and recovery. Even when the physical incident does not end in payment, the attempt itself can still be informed by data gathering and may be followed by financial workflows designed to reduce traceability.

Earlier editorial conversations in the ecosystem have also focused on how hardware wallet compromises and operational security failures can expose holders to theft. However, Chainalysis’ wrench attack analysis is distinct: it centers on physical coercion and the data pathways used to identify victims, not on whether a particular device type is broadly insecure.

For those tracking broader security trends, the wrench attack pattern may be best understood as an extension of cybercrime into real-world harm — where leaks and compromised records help criminals select targets, and where execution ranges from amateur violence to more professional money movement.

What to watch next

As reporting continues and law enforcement in high-incidence regions refines alerts, protection, and data-sharing efforts, the key unknown will be whether the decline in payment success rates translates into fewer total victims—or whether attackers will keep increasing attempts to maintain revenue. Crypto holders should also watch for further disclosures about data exposure pathways, particularly involving personal records that could make individuals easier to target.

This article was originally published as Chainalysis: Crypto “wrench” attacks top $30M stolen in 2026 on Crypto Breaking News – your trusted source for crypto news, Bitcoin news, and blockchain updates.