Chainalysis: Crypto “wrench” attacks top $30M in 2026

Crypto’s security threat is no longer confined to hacked exchanges, phishing links, or compromised custody. According to a report released this week by blockchain analytics firm Chainalysis, criminals carried out more than $30 million in thefts through “wrench attacks” in the first half of the year—an alarming category of violent crimes that targets crypto holders using threats, coercion, kidnappings, and home invasions.

Chainalysis documented 46 violent crypto-related incidents globally through late June, up from 40 in the same period of 2025. If the pace holds, the year would exceed the $58 million record reported stolen via these physical attacks in 2025.

Key takeaways

• Chainalysis tracked 46 “wrench attacks” worldwide through late June, rising from 40 during the same period in 2025.
• Despite the violence, attacker “success” remains relatively low: only 12 of the 46 incidents resulted in payment (about 26%).
• France is the clear hotspot, with 30 publicly known incidents by midyear versus 19 throughout all of 2025; authorities reportedly recorded more than 70.
• Chainalysis links the increase to suspected data leaks and targeted selection of victims, not random violence.
• Some attackers appear operationally sophisticated—moving funds through exchanges, bridges, decentralized platforms, and laundering services—suggesting ties to broader criminal networks.

What Chainalysis calls “wrench attacks”

In Chainalysis’s terminology, wrench attacks are physical coercion attempts used to force victims to hand over crypto. The report highlights scenarios including kidnappings, home invasions, and hostage situations. While these crimes are often described in sensational terms, Chainalysis frames them as a structured threat model: victims are selected in advance, and the violence is used to extract access or payments.

The report underscores a key tension for investors, traders, and everyday holders: the risk extends well beyond software security and custody choices. Even people who hold funds safely—offline or with reputable custody solutions—could still be targeted if criminals believe they can force them to act under duress.

Chainalysis also cautioned that the totals likely understate the real problem. The firm noted that many attacks go unreported, meaning public documentation can lag behind actual victimization.

Fewer payments than last year, but the volume is rising

Although the number of violent incidents is increasing, Chainalysis reports that outcomes are not as consistently successful as the headlines might suggest. Of the 46 incidents recorded, only 12 resulted in a payment, producing a 26% success rate.

That rate is down significantly from 49% in 2025, when nearly half of documented attempts resulted in payments. For readers, this matters because it suggests attackers are facing more resistance—or, alternatively, that they are running larger operations with a higher proportion of failed attempts. In either case, a lower success rate does not necessarily mean the threat is shrinking; it can simply mean criminals are conducting more operations to reach the same or greater totals.

Chainalysis described the modus operandi as uneven in capability: “tradecraft tends to be amateur at the point of violence, but professional at both ends.” In other words, criminals may not execute the coercion with high technical skill, but the processes before and after the violence—such as identifying targets and monetizing stolen funds—can be more refined.

France emerges as the main battleground

The most striking geographic detail in the Chainalysis report is France’s concentration of documented incidents. The firm says France recorded 30 publicly known wrench attacks by midyear, compared with 19 incidents reported during all of 2025.

Chainalysis further notes that French authorities have counted more than 70 incidents overall. That gap implies that public figures represent only a portion of what investigators and officials are tracking, again reinforcing the likelihood that reported totals undercount the true scale.

The report also aligns with official comments earlier in the year. In July, France’s Interior Minister Laurent Nuñez put the first-half count at 77 kidnappings, extortions, or attempted extortions—rising from 45 across all of 2025. According to that reporting, France has introduced a rapid-alert and protection system and promised enhanced intelligence-sharing and coordination with the crypto industry.

Data leaks, suspected tax-record misuse, and how criminals move money

Chainalysis attributes the surge in France largely to suspected misuse of French tax records. The report states that a French tax official allegedly accessed and sold information about crypto investors to criminals. Chainalysis also references a separate breach at crypto tax-reporting company Waltio, which was reportedly linked to exposure of data for about 50,000 users.

For holders, the implication is direct: wrench attacks appear to rely on victim identification rather than luck. If criminals can pinpoint which individuals likely hold valuable crypto and when they might be vulnerable, the physical attack becomes more targeted—and potentially more scalable.

The report also describes how stolen funds may be handled differently depending on the sophistication of the perpetrators. In some cases, attackers allegedly sent funds straight to centralized exchanges. Other cases involved the use of bridges, decentralized exchanges, and laundering services. Chainalysis said the most advanced incidents showed links to broader criminal networks, suggesting that the people carrying out violence may not be the same actors responsible for the entire financial operation.

That split matters for prevention: it suggests that public safety measures alone may not be sufficient. A credible response likely needs both improved physical protection for potential victims and stronger controls around data access—especially in areas where personal financial information can be accessed or exported improperly.

As this threat evolves, readers should watch whether the reported incident counts continue to rise in France and whether success rates remain suppressed or begin to climb again. Chainalysis’s findings also point to a key indicator for future risk: the extent to which leaked or misused financial data continues to supply criminals with targets.