Chainalysis report: Violent encryption attacks in the first half of 2026 cost $30 million stolen

Violent attacks on cryptocurrency holders surged in the first half of 2026, with more than US$30 million stolen globally.

Blockchain analysis company Chainalysis released a report saying that violent attacks on cryptocurrency holders surged in the first half of 2026, with more than US$30 million stolen globally. The report, released Thursday, noted that such crimes hit record highs this year.

Home robberies and kidnappings surge

As of the end of June, Chainalysis recorded 46 incidents involving armed robbery, kidnapping, home robberies and hostage-taking. These incidents have caused huge financial losses to victims, as criminals increasingly view cryptocurrency holders as high-value targets and their assets can be transferred instantly.

The company reported: "In recent years, there has been a surge in violent attacks against cryptocurrency holders, including home invasions, kidnappings and hostage-taking, which the security community sometimes calls 'wrench attacks'. Criminals have realized that cryptocurrency holders have wealth that can be transferred immediately and irreversibly and are therefore high-value targets."

A "wrench attack" refers to forcing a victim to transfer cryptocurrency through threats or force. Although kidnappings are still common, the proportion of recorded incidents has increased from 26% in 2023 to 37%. Attackers are also increasingly targeting relatives and acquaintances of victims to coerce them into transferring digital assets.

Chainalysis said that burglary allows criminals to commit crimes in a controlled environment and makes it easier to force victims to take action, while kidnapping requires careful planning and exposes offenders to greater risks over time.

Dictionary: Wrench attack, a term in the field of cryptographic security, refers to a personal attack in which criminals use direct force or threats to force victims to disclose and transfer their digital assets.

French data leaks cause a surge in attacks

According to Chainalysis, as of mid-2026, France has recorded 30 publicly known "wrench attacks" incidents, ranking first in the world. The analytics firm linked the surge in attacks to a suspected tax record leak that exposed the identities and financial information of cryptocurrency holders, leading to an increase in attacks by organized criminal groups.

The French authorities expanded the scope of their investigation and in April prosecuted 88 suspects, including more than 10 minors, in 12 separate operations against these violent groups.

In June this year, a French man was charged on suspicion of impersonating a police officer and participating in a "wrench attack." Convictions in the UK also made headlines this week, when five men were found guilty of imprisoning and torturing two French cryptocurrency millionaires for extortion in London.

Countries/regions| Recorded "wrench attacks" incidents (January to June 2026)

France: 30 incidents
Other countries: 16 incidents

Attackers used multiple money laundering methods

Chainalysis observed that there were significant differences in the complexity of the methods used by attackers when transferring stolen cryptocurrencies. Some criminals immediately transfer assets to centralized exchanges, leaving clear traces; others use decentralized platforms, cross-chain bridges, and automated trading tools to confuse funds and avoid tracking.

The company pointed out: "Medium-level attackers are more familiar with the encryption infrastructure. They may use decentralized exchanges, cross-chain bridges, MEV robots and other DeFi tools to exchange and transfer assets across chains. They understand that centralized exchanges are regulatory bottlenecks and have sophisticated compliance plans and user KYC mechanisms, so they try to avoid or delay interacting with them."

Small Dictionary: MEV Robot, a dedicated software that extracts additional value from blockchain transactions by taking advantage of differences in transaction ordering in decentralized financial protocols.

Recent cases and broader context

Several high-profile attacks have made international headlines in recent months. In February this year, blockchain security company CertiK reported that "wrench attacks" incidents increased by 75% in 2025, reaching a record of 72, with France being the hardest hit.

CertiK also estimates that global financial losses caused by the "wrench attack" soared to US$124 million in the first half of 2026. Meanwhile, in the United States, bitcoin extortion demands have emerged in several high-profile incidents, including the kidnapping of the mother of "Today Show" host Savannah Guthrie.

Chainalysis said criminals have realized that cryptocurrency holders have wealth that can be transferred immediately and irreversibly and are therefore high-value targets. They are increasingly targeting relatives of victims and using both basic and advanced money laundering techniques after attacks.