Crypto-related home invasions jumped from a single incident in the first half of 2025 to roughly 20 in the same period this year, according to a CertiK report released July 23. The broader category of 'wrench attacks' — where victims are physically coerced into handing over crypto — rose 33.3% to 52 verified cases in H1 2026, with financial exposure ballooning to $124.1 million from $10.5 million a year earlier.
33 cases in France
Europe accounted for 39 of the 52 verified incidents in H1 2026. France alone was responsible for 33 of those. That's a staggering concentration — more than half of all wrench attacks globally happened in a single country. The report doesn't specify why France is such a hotspot, but the numbers suggest attackers there have found a profitable formula.
From leaked databases to your doorstep
Attackers aren't picking targets at random. CertiK says they use data profiling from leaked databases, tax records, exchange data, social profiles, and real estate information. That means a public wallet address tied to a real name, a flashy social media post, or even a property record can put a holder in the crosshairs. The physical coercion bypasses all the digital security in the world — no private key is safe when someone is holding a wrench to your head or threatening your family.
Multisig, delays, and freeze buttons
CertiK recommends a layered approach to mitigate the risk. Multisignature or multiparty computation with geographically distributed signers can prevent a single point of failure. Additional layers include withdrawal delays, transaction caps, allowlists, staged vaults, and independent emergency freeze mechanisms. The idea is to make it impossible for one person under duress to move all funds instantly.
Criminal data markets and proxy targeting
Looking ahead to H2 2026, CertiK flags three possible developments: geographic shifts as law enforcement in France cracks down, proxy targeting where attackers go after custodians or family members instead of the holder directly, and the emergence of criminal identity-data markets that package the profiling information attackers already use. The report doesn't assign odds to any of these scenarios, but the H1 data makes one thing clear: physical coercion is no longer a fringe threat in crypto.
