Criminal groups have robbed cryptocurrency holders of more than $30 million through physical attacks in the first half of 2026, according to data from the analytical company Chainalysis in a report provided to the media today. Judging by the growth rate, the figure could exceed the record $58 million stolen in the same manner throughout all of 2025.
According to the company, by the end of June, 46 cases of violent crime related to cryptocurrency have been recorded worldwide — compared to 40 for the same period in 2025. This category includes kidnappings, home invasions, and hostage-taking — such attacks in the industry are commonly referred to as "wrench attacks" (where the perpetrator obtains a wallet password not through hacking, but with a "soldering iron").
The increase in the number of incidents expands the range of threats for cryptocurrency holders: in addition to the risks of storing and managing assets, their personal safety, homes, and families are increasingly under threat.
Only One in Four Attacks Results in a Ransom
Out of the 46 documented attack attempts, a ransom was paid in only 12 cases — the share of successful attacks was 26%, whereas in 2025 it reached 49%. At the same time, the report itself notes: the real scale of the problem is likely underestimated, as a significant portion of attacks remain unreported.
In Chainalysis's wording, the criminals' craft appears amateurish at the moment of violence itself, but professional at both ends of the chain: victims are most often identified in advance — through data leaks, social media, or insider information — and the actual attack is then carried out by low-skilled executors.
France Remains a Hotspot
The highest number of publicly known incidents occurred in France — 30 cases by mid-year compared to 19 for the entire year of 2025. However, French authorities have counted over 70 incidents, indicating a significantly higher real scale of the problem.
In July, French Interior Minister Laurent Nuñez cited a figure of 77 kidnappings, extortions, and attempted extortions in the first half of the year — against 45 for all of 2025. In response, authorities launched a rapid alert and protection system and also promised to expand intelligence sharing and coordination with the crypto industry.
According to Chainalysis, the most likely cause of the surge was a tax data leak: an employee of the French tax service allegedly gained access to information about cryptocurrency holders and sold it to criminals. A separate leak occurred at Waltio, a company dealing with cryptocurrency tax reporting — it affected data of approximately 50,000 users.
How Criminals Launder the Stolen Funds
On-chain activity after attacks shows varying levels of sophistication:
- some of the stolen funds are immediately sent by criminals to centralized exchanges;
- others use blockchain bridges, decentralized exchanges, and money laundering services;
- the most complex cases, according to Chainalysis, are linked to large criminal networks.
The surge in physical attacks in the first half of the year is already outpacing last year's figures, and France remains the country with the highest number of recorded cases. Leaks of personal and tax data, it seems, are becoming one of the key factors by which criminals find their victims.
AI Opinion
From the perspective of machine data analysis, it's interesting to compare the methodologies of different analytical companies. In parallel with the Chainalysis report, data is also provided by another entity — CertiK, which recorded 52 cases of "wrench attack" in the first half of 2026 compared to 39 the previous year, representing a 33% growth. The difference in numbers between the two companies (46 by Chainalysis vs. 52 by CertiK) is telling in itself: a unified methodology for counting such incidents in the industry does not yet exist, meaning the real scale of the problem remains a matter of estimation, not precise measurement.
