These crimes fall into a category that security researchers refer to as "wrench attacks." The term originates from an old internet joke about hacking: no matter how secure a password is, a criminal can bypass it with a five-dollar wrench and physical pressure. In practice, this means home invasions, kidnappings, and hostage situations targeting owners of cryptocurrency assets.
In its latest research, Chainalysis explained that this scheme differs from typical cryptocurrency crimes. Most thefts occur online through hacks, scams, and ransomware. Wrench attacks happen in person, often right at the victim's front door.
France Becomes a Global Epicenter of This Problem
France has become a focal point of this trend. According to Chainalysis, by mid-2026, the country had recorded 30 publicly known violent incidents, compared to just 19 in the entire previous year. French Interior Minister Laurent Nuñez stated in June that authorities had recorded over 70 violent incidents related to cryptocurrencies—a figure significantly higher than official data. Nuñez announced plans to create a rapid alert system to protect people working in the cryptocurrency industry who may be at risk.
Chainalysis linked the surge in attacks in France to a data leak. A French tax official is accused of stealing and selling files containing information on wealthy cryptocurrency owners, including names, addresses, phone numbers, and account balance data. It is suspected that criminal groups purchased this information and used it to plan attacks. A second leak, reported in January by the cryptocurrency tax company Waltio, led to the exposure of approximately 50,000 additional user records.
These numbers show how significant these stolen data were. Before 2025, France averaged less than one attack per month. Research by the blockchain analytics company Chainalysis showed that in 2025, this rate increased to 1.9 attacks per month, then sharply rose to 4.6 per month in the first half of 2026.
Attackers More Often Fail in France
Not every attempt is successful. Chainalysis reported that only 26% of attempted violent thefts by the end of June resulted in ransom payments, down from 49% in 2025 and 67% in 2024. The researchers who prepared the report directly linked the decrease in success rate to France, noting that attacks in this country are "more numerous, more chaotic," and less likely to succeed than the targeted attacks characteristic of previous years.
The nature of attacks is also changing worldwide. Home invasions accounted for 37% of recorded incidents in 2026, compared to 26% in 2023. The number of kidnappings also increased—from 39% of cases in 2023 to 52% now. Attackers have also begun targeting family members and acquaintances of the cryptocurrency owner instead of acting directly against them. Chainalysis found that such tactics were used in roughly a quarter to a third of cases worldwide, but in France, they were used in over 40% of cases.
Stolen Funds Reveal Who Is Behind the Attacks
Once an attack is successful, the stolen cryptocurrency needs to be moved somewhere. Chainalysis traced the money flows and identified three levels of complexity in criminal schemes. Some attackers send the stolen funds directly to a centralized exchange—a mistake that allows investigators to easily track and catch them. Others use decentralized exchanges (DEX) and cross-chain bridges to cover their tracks. A third group appears to be linked to organized crime: funds pass through money laundering networks associated with drug trafficking and terrorism financing.
JUNALCO Fights Organized Crime
French authorities view this wave of crimes as an expression of organized crime. The country's specialized unit for combating organized crime, known as JUNALCO, has made about 200 arrests and filed 88 charges related to cryptocurrency-linked attacks; 75 suspects are in pre-trial detention.
In its latest crime analysis, Chainalysis explained that the risk primarily falls on locals rather than tourists. In France, 93% of victims whose residence is known were locals; researchers believe this pattern indicates careful planning by the attackers, whether using data leaks, social media, or blockchain tracking.
Cryptocurrency Owners Face the Need to Enhance Security Measures
For cryptocurrency owners, the report's recommendations are simple. Do not flaunt large assets, do not disclose information about asset storage, and treat any leak of personal information as a security threat, not just a privacy violation.
In the second half of 2026, it will become clear whether France's measures lead to a slowdown in crime rates. Stay tuned for updates from JUNALCO on new arrests, the implementation of the rapid alert system proposed by Nuñez, as well as Chainalysis's year-end data, which will confirm whether 2026 becomes the worst year on record for violent crimes related to cryptocurrencies.
end-content
