Crypto wrench attacks hit $124M — and 2 in 3 were in France

The assumption that crypto wrench attacks track the bitcoin price is wrong, and CertiK's own data is what disproves it. Its H1 2026 Wrench Attack Report logs 52 verified incidents worth $124.1 million — an 11.8-fold jump from $10.5 million in H1 2025, or 1,079% growth against an incident count that rose only 33.3%. If price drove this, the two lines would move together. They did not. The report states the mechanism plainly: "The most important forecasting variable is not the price of bitcoin alone. It is the visibility of holders. Bull markets increase perceived wealth, but data exposure determines whether attackers can identify and locate that wealth." The geography proves it. France accounted for 33 of 52 incidents — 63.5% of the global total and 84.6% of all European cases. France is not the world's largest crypto market. It is, however, the jurisdiction that suffered two mass identity-data breaches feeding directly into this window: the France Travail compromise that drew a €5 million CNIL fine, and an ANTS portal breach exposing identity data for up to 19 million citizens. Having covered this beat through the Minnesota gunpoint case and the French ransom wave, the pattern that emerges is not a bull-market phenomenon. It is a data-broker phenomenon that happens to settle in crypto — and the second thing the numbers show is that even 52 is a floor, not a total. Key Facts:

• 52 verified incidents globally in H1 2026, up 33.3% from 39 in H1 2025 — CertiK Intel3D • $124.1 million recorded exposure vs $10.5 million a year earlier — an 11.8x increase • Average exposure per incident rose from $270,000 to $2.39 million • France: 33 incidents (63.5% of global); Europe overall 39 of 52 (75%), up from 35.9% in H1 2025 • Home invasions: 20 incidents, up from 1 — roughly 41% of all H1 2026 cases • French Interior Minister Laurent Nuñez counts 77 crypto-related physical incidents in France alone, against CertiK's 33 — the gap is methodology, not error • Approximately 200 arrests in France since January, with several dozen identified as minors

Why the two headline numbers disagree — and why that matters

Two figures are circulating and they do not match. CertiK counts 33 French incidents. Nuñez counts 77. Reddit picked up the discrepancy before most outlets did: an r/Bitcoin post on July 6, 2026 titled "France logs 77 crypto kidnappings and extortions in 6 months (+71% vs 2025), government unveils new security plan" drew 172 upvotes and 44 comments. Both numbers are correct. They measure different things. CertiK's methodology admits only "verified and publicly reported incidents," and its limitations section is unusually candid: under-reporting driven by victim fear of retaliation, reputational damage, tax exposure and law-enforcement inaction; classification variance where the same event is logged as robbery, kidnapping, extortion or assault without any digital-asset marker; and reporting lag where incidents surface weeks later. The French Direction nationale de la police judiciaire recorded 41 incidents between January and March 2026 alone — more in one quarter than CertiK logs for the entire half-year in that country. The operational conclusion is uncomfortable but unavoidable: $124.1 million is a floor. Any risk model built on 52 incidents is modelling the reported subset of a category whose defining feature is that victims have strong incentives not to report. Treat the CertiK figure as the visible portion, and size exposure accordingly. Quick Take: CertiK counts 52 globally; France alone reports 77. Neither is wrong — CertiK counts only verified public incidents and says so. The real global figure is materially higher, and $124.1M is the floor.

What actually changed in 2026: the front door

The single sharpest movement in the data is the attack vector. Home invasions went from 1 incident in H1 2025 to 20 in H1 2026 — roughly 41% of all cases. Kidnappings rose more modestly, 12 to 16. Torture held at 4 confirmed cases; murder at one in each period. That shift matters more than the headline dollar figure, because it changes what security means. A kidnapping is an interception problem — it happens in transit, and it can be mitigated with route variation and travel discipline. A home invasion is a perimeter problem. CertiK describes it as attacking a victim's "entire security perimeter," and the access vectors it catalogues are mundane rather than sophisticated: doorbell impersonation as delivery workers, utility staff or law enforcement; fake business meetings and OTC trades; transit interception at airports, hotels and event venues; and proxy targeting of family members, employees and associates. Forensic psychologist Dr Leslie Dobson described the pattern to a combined audience of roughly 17,000 across Instagram and TikTok on July 4, 2026: "A man answered his front door expecting a package. An hour later, he'd been beaten, bound and duct taped, threatened with having his fingers cut off, and robbed of $13 million. And as a forensic psychologist, I can tell you that's not a … random crime. It's targeted, coordinated, and it's escalating." That framing — targeted rather than opportunistic — is the whole point. These crews are not finding victims by accident. They are buying them.

The industry response: what holders and platforms are actually doing

The most-discussed community post on this subject in the last month was not about France. An r/Bitcoin thread on July 10, 2026 — 259 upvotes, 93 comments — carried the title "Wrench attacks on Bitcoin and crypto holders are up 75% in a year, and most victims now aren't even holders." That last clause matters, because it independently corroborates one of CertiK's four H2 scenarios. The report identifies proxy escalation — attackers increasingly targeting family members, employees, drivers and assistants "because they're easier to approach and produce stronger emotional leverage." The community noticed the shift before the report formalised it. Hacker News has been the densest venue for the technical debate, with 14 threads drawing 960 points and 707 comments over the period. On the retail side, r/Cold_Wallets ran "What Is a Wrench Attack and How Do You Protect Yourself?" on July 11, and even r/Buttcoin — the crypto-sceptic community — opened a thread specifically to dissect the CertiK overview. The defensive playbook the report recommends is notable for what it does not include: no reliance on stronger passwords or better hardware wallets, because neither survives physical coercion. Instead it converges on friction and separation: multisig or MPC controls that remove any single person's unilateral authority; withdrawal time locks, spending caps and allowlists; geographically separated signing devices and recovery material; small daily-spend wallets isolated from holdings; and family duress protocols with code words. For platforms the ask is architectural — design for duress with delayed withdrawals, emergency freezes and spending caps. This is the same direction institutional custody has been travelling since the audit-confidence debate we covered when institutions began looking past crypto audits alone: controls that assume the human will be compromised, not that the key will.

The data trail: what the numbers show when you line them up

MetricH1 2025H1 2026ChangeVerified incidents3952+33.3%Recorded exposure$10.5m$124.1m+1,079%Average per incident$270,000$2.39m+785%Home invasions120+1,900%Kidnappings1216+33%Europe share35.9%75.0%+39.1ppAsia incidents136−54%South America71−86%Source: CertiK Intel3D H1 2026 Wrench Attack Report. Percentage-point change shown for share figures. Read the columns against each other and the story separates from the headline. Incidents rose 33%. Exposure rose 1,079%. The severity per incident grew roughly 24 times faster than the frequency. Attackers are not casting a wider net; they are hitting far better-chosen targets. That is the signature of intelligence-led selection, not opportunism. The regional inversion supports it. Asia fell 54%, South America 86%, Africa to zero — while Europe's share more than doubled to 75%. Crypto ownership did not migrate to Europe in six months. Exploitable identity data did. Individual cases show the range. In Le Chesnay-Rocquencourt near Paris in March 2026, a couple were forced to transfer roughly €900,000 in bitcoin during a home invasion, with no recovery reported. In Malaysia on April 17, 2026, a South Korean national was abducted travelling from Genting Highlands and held four days; attackers demanded 10 million USDT, were paid 3 million, and Malaysian authorities recovered 2.46 million. In the UK on March 4, 2026, the pseudonymous holder Sillytuna was forced to surrender approximately $24 million in aEthUSDC, with the proceeds allegedly laundered across multiple chains before conversion to Monero — a case the victim disclosed publicly on X. Quick Take: Frequency +33%, severity +785%. Attackers aren't finding more victims — they're finding better ones. That gap is the entire finding.

The regulatory tension nobody wants to name

Here is the uncomfortable part. The mechanism CertiK identifies as the driver — centralised records linking a person's identity, address and crypto wealth — is precisely what the compliance regime has spent 2026 building. DAC8 took effect on January 1, 2026, obliging EU crypto-asset service providers to report and automatically exchange crypto transaction information between EU tax authorities. The report is direct about the consequence: that exchange "creates valuable targeting records," and demands strong access logging, insider monitoring, retention limits and breach notification. The evidence that this is not hypothetical is already in the record. A French tax administration employee allegedly sold confidential cryptocurrency investor data to criminal networks. Kraken disclosed an extortion attempt involving malicious insiders recording client-support systems displaying customer data. Dark-web recruitment posts openly solicit crypto platform employees for internal access. FinanceFeeds reported the early version of this thesis in April 2026, when Pavel Durov linked the France kidnapping surge to alleged tax-data leaks. At the time it read as a provocative claim from a founder with his own history of friction with French authorities. CertiK's H1 report now documents an insider case inside the French tax administration. The claim has aged into a finding. None of this is an argument against DAC8, MiCA or the Travel Rule. It is an argument that the threat model for those databases was written for tax evasion and money laundering, not for kidnapping. A dataset that maps identity to wealth is a compliance asset to a regulator and a target package to a crew. France has now demonstrated what happens when that dataset leaks in a jurisdiction with a visible crypto population — a pattern we tracked as France moved to a tougher crypto security plan after 77 ransom incidents.

What happens next

First: the base case is roughly 100 incidents and $228 million-plus for the full year — CertiK's own arithmetic annualisation. Given the under-reporting the methodology concedes, treat that as conservative. The more useful forecast is severity: if the $2.39 million average holds while incident growth stays near 33%, full-year exposure clears $240 million without any acceleration in frequency. Second: expect displacement, not reduction, in France. Roughly 200 arrests since January and the Bajjou arrest in Morocco represent real enforcement pressure. But the report's displacement scenario is the likelier outcome — crews moving to neighbouring jurisdictions with weaker enforcement rather than exiting. Watch Belgium, Spain and Switzerland for incident counts rising as France's fall. Q2 2026 already showed France stabilising at 17 incidents, matching Q2 2025, while the half-year total stayed elevated. Third: proxy targeting becomes the dominant vector by H1 2027. The logic is brutal but simple — a founder may run multisig, but their assistant has a home address and no security budget. The r/Bitcoin community flagged this in July before the report formalised it, and the shift from 1 to 20 home invasions shows attackers already prefer the softest perimeter available. Boards should be asking a question most have not: whether any threatened employee, contractor or family member could move assets, approve a transaction or expose user data. The uncomfortable strategic conclusion is that the crypto industry's security spending is concentrated almost entirely on the layer attackers have stopped bothering with. Smart-contract audits, key management and cold storage all assume the adversary attacks the system. Increasingly, the adversary attacks the person who holds it — and finds them through a database that a compliance regime required someone to build.

FAQ

What is a wrench attack in crypto? CertiK defines it as a physical coercion incident in which adversaries use violence, intimidation or credible threats to compel a victim to transfer digital assets, surrender private keys, unlock a wallet, reveal credentials, or pressure a third party into compliance. The name comes from a 2009 XKCD comic pointing out that strong encryption fails against someone willing to use a $5 wrench. How many crypto wrench attacks were there in 2026? CertiK verified 52 incidents globally in H1 2026, up 33.3% from 39 in H1 2025, with $124.1 million in recorded exposure. That count includes only verified, publicly reported cases — French authorities alone recorded 77 crypto-related physical incidents in the same period, so the true global figure is materially higher. Why are so many crypto kidnappings happening in France? France recorded 33 of 52 global incidents, or 63.5%. CertiK attributes it to a large, visible crypto ecosystem combined with major identity-data exposures — the France Travail breach that drew a €5 million CNIL fine and an ANTS portal breach affecting up to 19 million citizens. Data exposure, not market size, is the driver. Are wrench attacks linked to the bitcoin price? Less than assumed. CertiK's report states the key forecasting variable is holder visibility rather than price: bull markets raise perceived wealth, but data exposure determines whether attackers can actually identify and locate a holder. Incidents rose 33% while exposure rose 1,079% — severity scaled with targeting quality, not price. How do you protect yourself from a wrench attack? Reduce public exposure (no portfolio screenshots, wallet addresses, home details or travel plans), split holdings into small spending wallets separate from vaults, adopt multisig or MPC so no single person holds unilateral authority, add withdrawal friction through time locks and allowlists, geographically separate signing devices from recovery material, and agree family duress protocols including code words. What is a wrench attack by proxy? Targeting someone adjacent to the asset holder — a family member, employee, driver or assistant — rather than the holder directly. CertiK flags it as a rising H2 2026 scenario because proxies are easier to approach and create stronger emotional leverage. It is why corporate security programmes now need to extend past the executive. Related coverage: the Minnesota family held at gunpoint in an $8 million crypto theft and Galaxy's $5 million commitment to post-quantum bitcoin security. This article is informational analysis only and is not investment, legal or security advice. Individuals facing a credible physical threat should contact local law enforcement. Figures are drawn from CertiK's H1 2026 Wrench Attack Report, which explicitly notes severe under-reporting in this category.