France recorded 90 cryptocurrency-related cases involving kidnapping, abduction, extortion, threats and violent theft from Jan. 1 to mid-August 2026, according to figures the French Interior Ministry provided to Cointelegraph.
The ministry said 223 arrests were made in connection with those cases, and 126 people were imprisoned between January and July.
That pace works out to one new case roughly every two and a half days. Still, there is no official year-over-year comparison. The ministry said it does not have statistics for 2025 because recording for these categories began only on Jan. 1, 2026.
The new figures stand well above other public trackers of real-world crypto attacks. Chainalysis counted 30 publicly known violent crypto incidents in France through mid-2026, while noting that the true scale was “almost certainly larger.” Security firm Gart.io tracked 73 attacks in France year to date, putting the country in first place ahead of the United States on 66 and the United Kingdom on 27.
The rise in physical attacks on crypto holders, often called wrench attacks, points to something broader than isolated incidents. The report highlights leaked personal data as a possible driver.
Why France stands out
Wrench attacks are not new. Bitcoin security advocate Jameson Lopp’s long-running directory of known physical attacks lists 365 cases across 60 countries between 2014 and 2026, with France at the top.
What appears newer is the speed of the spread inside the country. According to Chainalysis, attacks have moved beyond Paris and have also been recorded in Strasbourg, Marseille, Grenoble, Toulouse and Nantes.
The victims are not mainly wealthy crypto tourists. Among victims whose residency is known, 93% were French residents.
Eric Jardine, head researcher at Chainalysis, told Cointelegraph the surge is “very likely” tied to a “significant data breach.”
That makes these attacks especially difficult because they can begin long before an assailant appears and demands a seed phrase or a crypto transfer. Attackers first need to know who holds something worth stealing, where that person lives and how to reach them.
Jardine pointed to a 2024 compromise at the French tax authority, where a tax official in the Paris area “leaked PII, financial and crypto holding information on French taxpayers,” as a possible accelerant. Chainalysis records show attacks rising from late November that year.
Chainalysis also cited another incident in January 2026, when crypto tax reporting firm Waltio disclosed a breach affecting about 50,000 users. That incident created another pool of data that attackers could use to identify targets.
Francis Pouliot, founder of Canadian Bitcoin exchange Bull Bitcoin, has repeatedly challenged Europe’s DAC8 crypto reporting rules in France. Those rules expand tax reporting and information-sharing requirements for crypto users across the European Union.
“DAC8 has transformed the concept of Know Your Customer into Kill Your Customer,” he said. He also described France as the “crypto kidnapping capital of the world.”
When the person attacked is not the wallet holder
Chainalysis said one of the clearest shifts is in who gets targeted. Globally, relatives and acquaintances accounted for about 25% to 30% of violent crypto incidents by early 2026. In France, that share was more than 40%.
In May 2026, six men allegedly tried to abduct the wife of The Sandbox co-founder Sébastien Borget from the couple’s home in Villenoy, France. One attacker reportedly posed as a delivery driver to get her to open the gate.
In August, a couple in rural France reportedly faced three separate attempts to break into their home after buying a property previously occupied by crypto millionaires. The report said the former owners’ tax information and address had been leaked onto the dark web.
A similar method appeared in 2025. The father of a crypto entrepreneur was abducted in Paris and held for two days. The kidnappers reportedly cut off part of his finger and sent it to his son while demanding $5.6 million in cryptocurrency.
Jardine said the targeting of relatives and associates “suggests criminals are doing reconnaissance before they act,” whether by “monitoring social media, analyzing blockchain data, using leaked information, or receiving tips from insiders.”
That changes the usual picture of a crypto target. The person who controls the wallet may not be the person standing in front of the attacker.
French authorities are responding by treating the attacks as organized crime and coordinating investigations through JUNALCO, the country’s specialized organized crime jurisdiction.
The $5 wrench problem
Many crypto holders know how to protect seed phrases, use hardware wallets, test their setups and avoid phishing links.
But those measures do not solve the problem if an attacker already knows who they are, where they live and that they hold something worth stealing.
Cryptography can protect a wallet. It cannot stop an attacker with a $5 wrench.