Violent attacks on cryptocurrency holders are on track for their worst year yet, with more than $30 million stolen in the first half of 2026, according to a new report from blockchain analytics firm Chainalysis.
Published Thursday, the report logged 46 violent crypto-related incidents through late June and estimated losses at more than $30 million. Chainalysis said attacks on crypto holders, including home invasions, kidnappings, and hostage situations, have climbed in recent years. In security circles, these cases are often called "wrench attacks."
The term refers to the use of threats or physical violence to force a victim to hand over cryptocurrency. Chainalysis wrote that criminals have identified crypto holders as high-value targets because they control wealth that can be transferred instantly and irreversibly.
Kidnappings lead, but home invasions are taking a bigger share
Kidnappings remain the most common type of wrench attack in the dataset. Still, home invasions are becoming more common. Chainalysis said they accounted for 37% of documented incidents, up from 26% in 2023.
The firm also found that attackers are increasingly going after relatives and acquaintances as a way to pressure victims into making transfers.
"Home invasions allow criminals to confront victims in a controlled environment where they can compel a transfer of funds," Chainalysis wrote. "Kidnappings, by contrast, are much more difficult to execute. Attackers must expend considerable time and resources planning logistics; and the extended periods spent with victims leaves the attacker exposed for longer."
France recorded the most incidents
France has emerged as a major hub for wrench attacks. Through mid-2026, the country had recorded 30 incidents, more than any other jurisdiction covered in the report.
Chainalysis said the increase appears to be linked to an alleged breach involving tax records that exposed information about high-net-worth crypto holders.
Attackers show very different levels of sophistication on-chain
The report pointed to major differences in how stolen funds are handled after an attack. Some perpetrators appeared to have only a basic grasp of cryptocurrency and moved stolen assets directly to centralized exchanges without trying to hide the trail. Others used much more advanced methods to make tracing harder.
"Mid-tier attackers demonstrate greater familiarity with crypto infrastructure. They may use decentralized exchanges, bridges, MEV bots, and other DeFi tools to swap and move assets across chains," Chainalysis wrote.
According to the firm, these attackers understand that centralized exchanges are chokepoints with sophisticated compliance systems and user KYC requirements, so they try to avoid them or delay interacting with them.
Cases keep mounting in Europe and the U.S.
The report lands as violent attacks against crypto holders continue to rise.
In February, CertiK said wrench attacks rose 75% in 2025 to a record 72 incidents, with France emerging as the epicenter. In April, French authorities charged 88 suspects, including more than 10 minors, across 12 investigations as they widened a crackdown on organized groups tied to a wave of violent crypto attacks.
In June, French authorities indicted a man accused of taking part in a crypto wrench attack after allegedly posing as a police officer. In July, CertiK said financial exposure from wrench attacks had reached $124 million in the first half of 2026. This week, five men were convicted in London for imprisoning and torturing two French crypto millionaires in an extortion case.
Bitcoin ransom demands also drew attention in the U.S.
Outside Europe, Bitcoin ransom demands have also surfaced in major U.S. cases. Earlier this year, investigators found ransom notes demanding Bitcoin during the probe into the kidnapping of Nancy Guthrie, the mother of "Today" host Savannah Guthrie.