Home invasions became most common crypto wrench attack in H1 2026: CertiK

According to blockchain security firm CertiK, home invasions have become the most common form of crypto wrench attacks in the first half of 2026, escalating sharply to 20 publicly reported cases from just one in the same period a year earlier. Overall, CertiK verified 52 wrench attack incidents worldwide in this timeframe, marking a 33.3% increase from 39 incidents in the first half of 2025. Within these attacks, kidnappings rose to 16 from 12, while robberies declined to one from five. The total recorded financial exposure linked to these attacks reached approximately $124.1 million, a significant rise from $10.5 million during the first half of 2025. This figure encompasses ransom demands, victim transfers, assets that were frozen or recovered, and failed ransom demands, not only confirmed thefts.

Europe has seen a high concentration of these attacks, with 39 of the 52 verified incidents taking place there. Notably, France accounted for 33 cases, nearly two-thirds of the global total. CertiK’s numbers are based on a verification method limited to publicly reported incidents it could independently confirm, which is narrower than that used by French authorities. The French Interior Minister Laurent Nuñez reported 77 crypto-related kidnappings and extortion cases in the first half of 2026, up from 45 for the entire year 2025. The high concentration in France may be linked to its more visible crypto ecosystem, where data breaches have exposed identities and home addresses linked to perceived crypto wealth.

In response to the rise in attacks, French authorities have launched a prevention platform and rapid-alert system targeting crypto holders and professionals, which has reportedly resulted in 200 arrests. CertiK highlighted that the increase in physical coercion challenges typical self-custody advice for crypto assets. To mitigate risks, CertiK recommends security arrangements such as multisignature or multiparty computation wallets, withdrawal delays, spending limits, and geographically separated signers to prevent a single threatened individual from being able to access all available assets immediately.

The development is significant because it points to criminals increasingly circumventing digital security measures by physically coercing cryptocurrency holders and their families, thereby undermining conventional crypto asset protection strategies. CertiK’s findings emphasize a need for enhanced security protocols that account for risks arising from physical threats in addition to cyber vulnerabilities.