French authorities have logged 90 cases involving kidnapping, abduction, extortion, threats, and violent robberies tied to cryptocurrency in just over seven months, according to figures provided to Cointelegraph by the French Interior Ministry.

The ministry’s data covers Jan. 1 through mid-August 2026. During the same period, authorities recorded 223 arrests, and from January through July 126 people were imprisoned. With the reported incidents averaging roughly one every two and a half days, the scale is drawing attention—especially given the lack of an official year-on-year baseline for 2025, since the tracking began on Jan. 1, 2026.

Key takeaways

France recorded 90 crypto-related violent cases from Jan. 1 to mid-August 2026, alongside 223 arrests and 126 imprisonments (Jan–July).
Third-party incident trackers show higher-than-expected wrench attacks in France, with Gart.io placing the country at the top for real-world cases in the year to date.
Investigators suspect data exposure—not just opportunity—is helping criminals identify targets before violence begins.
Attackers are increasingly going after relatives and associates, implying reconnaissance and information-gathering beyond simply robbing “crypto holders.”
French authorities are treating cases as organized crime, using specialized coordination through JUNALCO.

France’s spike in “wrench attacks”

Violent crimes against crypto holders—often called wrench attacks—are not a new phenomenon. However, the French Interior Ministry figures suggest an unusually brisk pace of offenses, even without a formal comparison to earlier years.

The reported French tally is also notable compared with public tracking efforts focused on physical violence. Chainalysis counted 30 publicly known violent crypto incidents in France through mid-2026, while emphasizing the true number is likely higher. Meanwhile, security intelligence provider Gart.io has tracked 73 attacks in France in the year to date, placing France ahead of the United States (66) and the United Kingdom (27).

That mismatch between official figures and tracker estimates matters for investors, users, and builders alike: physical attacks may be underreported, and the fastest-moving parts of the threat may be the ones that never reach a public database.

Why data exposure may be driving the violence

According to Chainalysis, the rise in physical attacks in France likely reflects more than a run of isolated criminal activity. Head researcher Eric Jardine told Cointelegraph the surge is “very likely” connected to a significant data breach.

“These sort of breaches expose more than financial information; they reveal who holds crypto, where they live, and how to find them.”

The practical implication is that violence can be pre-planned. Even strong wallet security practices—such as hardware wallets, seed-phrase discipline, and phishing awareness—do not address the central vulnerability if attackers already know who has value and where that person can be reached.

Chainalysis points to a potential accelerant from the French tax authority compromise in 2024. In the account provided to Cointelegraph, a tax official in the Paris area reportedly leaked personally identifiable information and crypto holding information of French taxpayers. Chainalysis data shows attacks surged from late November of the same year.

The research also highlights another incident in January 2026, when crypto tax reporting firm Waltio disclosed a breach affecting some 50,000 users, potentially expanding the set of people criminals could identify as high-value targets.

Beyond breach mechanics, the broader policy backdrop is under debate. Francis Pouliot, founder of Canadian Bitcoin exchange Bull Bitcoin, has previously criticized Europe’s DAC8 reporting framework as it applies in France, arguing it can intensify information exposure. His comments, as cited by Cointelegraph, frame the issue as an inversion of customer due diligence.

Targets broaden beyond the wallet owner

One of the most consequential shifts described by Chainalysis is who criminals are actually seeking. Globally, relatives and acquaintances accounted for roughly 25% to 30% of violent incidents by early 2026. In France, however, that share rises to more than 40%.

That change can reshape how victims think about risk. If violence is directed at family members, partners, or close associates, the person who holds crypto may not be the person standing in front of attackers.

Chainalysis cites multiple examples reported in France during 2026:

May 2026: six men allegedly attempted to abduct Sébastien Borget’s wife from the couple’s home in Villenoy, France, with one attacker reportedly posing as a delivery driver.
August 2026: a rural French couple reportedly faced three separate break-in attempts after buying property previously occupied by crypto millionaires; Chainalysis attributes the lead to leaked tax information and address details appearing on the dark web.
2025 example: the father of a crypto entrepreneur was reportedly abducted in Paris and held for two days, with kidnappers allegedly cutting off part of his finger and sending it to his son while demanding $5.6 million in cryptocurrency.

Jardine argues that the focus on relatives and associates points to criminals conducting reconnaissance beforehand—potentially using social media monitoring, blockchain analysis, leaked databases, or information obtained from insiders. For users, this reinforces a critical distinction: operational security for your own accounts may not be enough if attackers obtain “target maps” that connect wallets to real-world networks.

French response: treating it as organized crime

French authorities are responding by treating the incidents not as scattered opportunistic robberies, but as part of organized criminal activity. Investigations are coordinated through JUNALCO, the country’s specialized jurisdiction for organized crime.

That matters because organized crime investigations tend to focus on supply chains—how criminals source information, acquire access to victims, and move through criminal networks—rather than merely pursuing the people who carry out the violence. If the link to leaked data is as strong as Chainalysis suggests, the investigative priority could shift toward the earlier stages of targeting.

Separately, Cointelegraph notes that a well-known directory of physical crypto attacks maintained by Bitcoin security advocate Jameson Lopp documents hundreds of cases across multiple countries between 2014 and 2026, with France listed at the top. That historical record underscores that wrench attacks are persistent worldwide—while the newer French spike highlights how rapidly the threat can intensify when information access improves.

The “$5 wrench” problem

For many crypto users, security advice has long focused on preventing compromise: securing seed phrases, using hardware wallets, and avoiding phishing traps. But the French episode described by Chainalysis and the Interior Ministry turns the lens toward a different failure mode—one that starts long before a criminal arrives.

Cryptography can protect funds; it cannot stop a determined attacker with a low-cost means of coercion if they already know who to find and why. As the case volume rises, the question for readers is not only how to harden wallets, but how to reduce the real-world exposure created when personal and financial information is leaked, aggregated, or reused.

Going forward, investors and users should watch whether French enforcement actions increasingly uncover the “source layer” of targeting—data breaches, information resales, and recruitment of inside tips—rather than only arresting perpetrators after violence begins. The uncertainty remains whether the current surge reflects a lasting structural change or a one-off acceleration tied to specific exposures in 2024 and 2026.