Cryptocurrency Physical Attacks Surge in Europe as Global Damages Exceed $101 Million
The European continent has become the primary target for physical cryptocurrency attacks, representing 82% of all global incidents, as total financial damages worldwide climb past $101 million—twice the amount recorded in 2025.
Global financial damages resulting from physical cryptocurrency wrench attacks have climbed to $101 million during the initial four-month period of 2026, with the European region experiencing the majority of these violent incidents, Web3 security firm CertiK has revealed.
Despite only 34 verified instances of crypto wrench attacks being recorded, the financial toll has approached double the 2025 figure of $52.2 million. The European continent has been the location for 82% of these cases, CertiK's data shows.
Our 2025 report documented a gradual tilt from Asia and North America toward Europe, and these first four months of 2026 mark a European hyper-concentration.
The occurrence rate of wrench attacks has escalated compared to 2025. These incidents utilize physical violence or intimidation to force victims to surrender access to their cryptocurrency assets and have manifested as residential break-ins, abductions and various forms of coercive tactics. According to CertiK's tracking, there have been 34 such attacks documented from January through April.
Should this pattern persist throughout the remainder of the year, CertiK forecasts that the total number of cases could climb to 130, with aggregate losses potentially reaching "several hundred million dollars."
France is an epicenter of wrench attacks
Among the total incidents, 24 cryptocurrency wrench attacks have taken place within French borders during this year, CertiK has reported. Meanwhile, France's National Prosecutor's Office for Organized Crime has documented an even larger number, citing 47 separate incidents in 2026.
According to CertiK's analysis, France has probably become an attractive target for these criminal operations due to the concentration of cryptocurrency industry leaders from prominent firms including Ledger, Paymium and Binance operating within its borders.
The security firm also highlighted multiple data breach incidents, including the January security compromise at cryptocurrency accounting platform Waltio and the case of tax authority employee Ghalia C, who faces allegations of providing cryptocurrency holder information to organized crime groups, combined with "a culture of flexing and voluntary doxxing that remains deeply embedded in the community."
"Early 2026 marks the shift to a data-driven targeting model in which prior physical surveillance becomes unnecessary once attackers have the victim's full name, home address, financial profile, and so on."
"The structural takeaway is clear: as the security of protocols and wallets tends to improve, the threat migrates toward the human link. As long as crypto-asset holdings remain associated with identifiable financial data, physical coercion will remain the economically most rational attack path," CertiK added.
Blockchain analytics provider TRM Labs published findings in May of the previous year indicating that wrench attacks have experienced an upward trajectory due to the apparent pseudonymous nature of cryptocurrency transactions, the public display of wealth on blockchain networks, and the simplicity with which malicious actors can compile personal information through online sources.
The criminal teams are often "complete amateurs"
Throughout the documented wrench attack cases, CertiK has observed that the masterminds behind these operations typically operate from locations outside the nation where the attack occurs. The actual criminal crews executing the attacks on the ground generally comprise three to five individuals, and they regularly disguise themselves as package delivery personnel or law enforcement officials, or entice targets into traps using deceptive schemes such as fabricated business appointments.
"Most of the time, they are recruited via messaging apps such as Telegram or Snapchat for a few thousand dollars. They don't know each other and are complete amateurs," CertiK added.
At the same time, Casa chief security officer Jameson Lopp has catalogued 31 cryptocurrency wrench attacks during the current year and disclosed in March that four incidents he was monitoring for his database proved to be cases of mistaken identity, where the perpetrators targeted incorrect victims.
During April, a minimum of 88 individuals, among them 10 underage persons, faced indictment in relation to suspected wrench attacks targeting cryptocurrency holders throughout France.
"The growing proportion of minors signals an increasing externalization of criminal liability toward profiles less exposed to mandatory minimum sentences," CertiK added.