The Wrench, Not the Hack: Why Attacks on Crypto Holders Jumped by a Third

Over the past six months, 52 publicly known attacks on cryptocurrency holders have been recorded. That is 33.3% more than a year earlier. But what is most alarming is not the number of attacks — it is the sums involved: losses grew nearly twelvefold. Let us break down what CertiK's data shows, why France turned out to be the epicenter, and how criminal tactics have changed. We will also look at why cryptocurrency owners turned out to be so vulnerable in the first place, and which measures actually reduce the risk.

What CertiK's Data Showed

For the first half of 2026, CertiK analysts counted 52 publicly confirmed attacks aimed at stealing cryptocurrency. For comparison, there were 39 such incidents in the first half of 2025. These are specifically offline attacks on people, not platform hacks: the criminals come for a specific person, knowing that he holds cryptocurrency.

The month-by-month picture is uneven. In January the number of attacks rose from 9 to 15, in March from 7 to 13, and in April from 2 to 8. In May and June, however, the trend reversed: 10 versus 6 and 5 versus 3 respectively.

An important caveat: the statistics reflect only confirmed cases. A significant share of incidents stays outside the reporting — victims often prefer to settle the matter privately, without drawing attention to their cryptocurrency holdings. Publicly admitting that substantial sums are kept at home automatically makes a person a target for the next group. That is why the real number of attacks is almost certainly higher than the official figures, and public reports capture only the tip of the iceberg.

Losses Grew Nearly Twelvefold

The sums changed far more dramatically than the number of attacks. The combined volume of extortion, hacks, and ransom demands rose from $10.53 million in the first half of 2025 to $124.18 million in the first six months of this year.

Per incident, the average loss jumped from $270,000 to $2.39 million. In other words, criminals are not simply attacking more often — they are deliberately picking targets who genuinely hold a lot of cryptocurrency.

That trajectory points to professionalization. Random muggings are happening less often, while carefully prepared operations against specific cryptocurrency owners are happening more. Attackers study the target in advance, gathering information about daily routines, family, and security. That preparation pays off: one successful attack brings in more than a dozen random robberies. Hence the sharp rise in the average haul — criminals are hunting not for passersby but for specific holders whose asset volumes they already know.

France Became the Epicenter

The geography turned out to be unexpected. Of the 52 confirmed cases, 39 occurred in European Union countries — roughly 75% of all known attacks.

But the real epicenter is France: it accounted for 33 of the 52 episodes, meaning 63.5% of the global total and 84.6% of European incidents. In effect, every second attack on a cryptocurrency owner worldwide happened there.

Why remains an open question. A high concentration of wealthy holders, the activity of specific criminal groups, and the industry's visibility in the country may all have played a role. French investors often speak openly about their projects, and that is already a ready-made target list. There is also a copycat effect: after the first high-profile episodes, the method spreads through criminal circles, while press coverage demonstrates that it works. As a result, an entire wave of near-identical crimes can build up in a single country.

Where Attacks Became Less Frequent

The situation did not worsen everywhere. In Asia, the number of incidents recorded by CertiK fell from 13 to 6, and in South America from 7 to 1.

In the US there were only five cases over six months, with two more incidents registered in the UK and two in Sweden. Isolated attacks were noted in Belgium, Cambodia, Canada, Hong Kong, Malaysia, the Philippines, Spain, Turkey, and the Middle East.

This spread shows that it is not simply about how many holders a country has. Far more important is a combination of factors: the availability of weapons, the effectiveness of police work, a culture of public visibility, and the presence of organized groups specializing in exactly these crimes. Tellingly, the US — which objectively has more cryptocurrency holders than France — recorded just five episodes. That points to the organization of specific groups rather than to market size.

The New Tactic: Home Invasion

The main change is the rise in attacks involving break-ins at private homes. In the first six months of 2025, only one such case was publicly confirmed; in 2026 the number climbed to 20. That is roughly 41% of all registered incidents.

One separate detail: attackers increasingly operate in small groups of three or four people and know in advance exactly where in the house to look for equipment and written records. The number of kidnappings rose from 12 to 16. Episodes involving torture stayed at four, and fatalities at one per half-year.

The criminals' logic is simple: if the keys to the cryptocurrency are held personally by the owner, it is easier to reach them through the person than through an exchange's protected systems. A hack requires skill and time, while physical pressure works in a matter of minutes. In the industry, such cases have long been called a wrench attack: instead of a complex workaround of cryptography, the criminal simply forces the victim to sign the transfer themselves. Neither long passwords nor hardware devices help against this if the owner is physically in the attackers' hands. Technology protects the data, not the person.

Pressure Through Loved Ones

A separate trend is indirect pressure. According to CertiK representatives, criminals gain access to assets through threats against spouses, children, parents, drivers, or company employees.

The calculation is that the people around the target have a far lower level of protection and stress readiness than the investor himself. Someone with no security detail and no training agrees faster — and the cryptocurrency goes to the attackers.

This changes the very logic of security. Protecting yourself is not enough: the entire circle of contacts comes under threat, including colleagues and drivers who may never think about cryptocurrency at all. The practical takeaway is unpleasant but important: the fewer people who know about your holdings, the safer it is both for you and for them. Even a casual remark to a colleague can set off a chain that brings criminals to your door weeks later.

How Criminals Find Their Victims

Target selection has long become a discipline of its own. Data leaks, tax registries, client databases from exchanges, social media profiles, and information from public blockchain transactions are all put to use.

The last item is especially troubling: the blockchain is transparent, and large investors who keep cryptocurrency at a single address effectively publish the size of their fortune. It is enough to link an address to an identity, and the target is ready.

Owners themselves also help. Stories about successful trades, photos of expensive purchases, geotags, and open profiles give criminals enough data to build a full picture of a person's life. It is especially risky to combine a public nickname with a real name: linking a social media profile to a wallet address in that situation is something even a novice can do. Leaks from services that store passport data and home addresses pose a separate threat — such databases surface on the dark web regularly.

The DAC8 Directive as a New Risk Factor

CertiK analysts named the DAC8 directive, which took effect in the European Union on January 1, as an important risk factor. The document obliges crypto-asset service providers to hand over information about client transactions to EU tax authorities.

The problem is not the reporting itself, but the appearance of new data sets. Any database that brings together names and holding volumes is a potential target for hacking and leaks.

Security specialists fear that the use of such information by fraudsters will lead to an even greater number of attacks on cryptocurrency owners. Earlier, police in France detained four men suspected in a series of attacks and kidnappings: they demanded that owners transfer funds under threat of physical violence. That episode illustrates the broader picture well: groups operate serially, running the same scheme on several victims in a row until they are caught. This is exactly why experts advise reporting even failed attempts to the police: scattered episodes often come together into a single case and help identify the organizers faster.

Who Crypto Investors Are and Why They Are Targets

In short, these are people who put money into digital assets: they buy cryptocurrency, keep it in wallets, trade on platforms, or take part in projects. The specific feature of crypto investing is that the owner is personally responsible for keeping the keys safe.

That is precisely why crypto investors make such convenient targets. A bank deposit comes with insurance and the option to dispute a transfer, whereas a cryptocurrency transfer is irreversible: once the transaction is signed, the funds are gone for good and cannot be recovered.

Add to that the transparency of the blockchain, and you get a combination that does not exist in traditional finance. Crypto investors both hold their capital personally and leave a digital trail by which that capital can easily be assessed from the outside. In traditional finance there is always an intermediary between the money and the criminal — a bank that will block a suspicious operation and return the funds. In crypto there is no such buffer, and all responsibility falls on the owner. That very autonomy, which the industry considers a virtue, turns into a vulnerability in situations like these.

How to Reduce the Risks

There is no universal recipe, but the basics work. Do not advertise the size of your portfolio, do not post screenshots of balances, and do not discuss your holdings in open chats or at public gatherings.

Split up your storage: keep part of your cryptocurrency in a hardware wallet and part in a multisignature setup where a single signature is not enough. Backup wallets holding a small amount are also useful — something you can hand over under duress without losing your main capital. Some owners additionally set up delayed transfers: the funds move with a lag, giving the victim a chance to cancel the transaction once the danger has passed.

Rethink your digital hygiene: different passwords, two-factor authentication, and a minimum of personal data on exchanges and social networks. Experienced investors also spread assets across several addresses so that no single wallet reveals the whole portfolio. It is worth thinking through everyday details too: do not keep your seed phrase at home in an obvious place, do not meet strangers about crypto matters alone, and do not share your home address with outsiders. These measures look excessive right up until the first incident happens.

The Bottom Line

CertiK's data records an unpleasant shift: crime around cryptocurrency is moving from online to offline. Breaking into a well-protected wallet is hard, while pressuring a person is far easier and faster.

As long as the market grows and data about owners becomes more accessible, the trend is unlikely to reverse. Investors can influence only what is within their power: privacy, distributed storage, and discretion in conversations about their own assets. The good news is that most of the measures described are free and demand discipline rather than money. The bad news is that the industry still has no answer to a threat whose main vulnerability is not the code, but the person.