France records 90 bitcoin-related attacks in seven months, report says

French official data: 90 cases of violence involving cryptocurrency occurred in seven months

According to data provided by France to Cointelegraph, in just over seven months, French authorities recorded 90 cases of kidnapping, abduction, extortion, threats and violent robbery caused by cryptocurrency. These data are provided by the French Ministry of the Interior and span from January 1 to mid-August 2026. During the same period, authorities arrested a total of 223 people, 126 of whom were imprisoned between January and July. Given that on average, one incident occurs every two and a half days, and since tracking starts on January 1, 2026 and lacks year-on-year benchmark data for 2025, this scale has attracted widespread attention.

Key Points

Case Statistics: From January 1 to mid-August 2026, France recorded 90 cases of cryptocurrency violence, accompanied by 223 arrests and 126 imprisonment (January to July).

Third-party tracking data: Third-party incident tracking agencies showed that the number of "wrench attacks" in France (crimes of coercing victims into surrendering cryptocurrency with arms) was higher than expected. Gart.io ranks France as the country with the most real world cases so far that year.

Data breaches drive crime: Investigators suspect that data breaches-not just opportunities to commit crimes-are helping criminals target before violence breaks out.

Expansion of attack targets: Attackers are increasingly targeting relatives and associates of victims, suggesting that the crime goes beyond mere robbery of "cryptocurrency holders" and involves broader intelligence gathering.

Classified as organized crime: The French authorities treat these cases as organized crimes and conduct coordinated investigations through the specialized agency JUNALCO.

The surge in "wrench attacks" in France

Violent crimes against cryptocurrency holders-often referred to as "wrench attacks"-are not new. However, data from the French Ministry of the Interior show that the frequency of these crimes is abnormally high even without formal comparisons with previous years.

The reported data in France is particularly significant compared to public tracking efforts that focus on physical violence. Chainalysis counted 30 publicly known incidents of cryptocurrency violence in France as of mid-2026, while emphasizing that the real number may be higher. Meanwhile, security intelligence provider Gart.io has tracked 73 attacks in France so far this year, putting France ahead of the United States (66) and the United Kingdom (27).

The difference between official data and tracker estimates is important for investors, users and practitioners: Physical attacks can be underreported, and the fastest-growing parts of the threat are often those that never enter public databases.

Why data breaches increase the risk of violence

According to Chainalysis's analysis, the increase in physical attacks in France is likely to be more than the result of a series of isolated criminal activities. Lead researcher Eric Jardine told Cointelegraph that the surge was "highly likely" related to a major data breach.

"Such leaks expose more than just financial information; they reveal who holds cryptocurrencies, where they live and how to find them."

The practical impact is that violence can be pre-planned. Even with strict wallet security measures-such as hardware wallets, mnemonic discipline and awareness of phishing-core vulnerabilities remain if the attacker already knows who has value and how to contact that person .

Chainalysis pointed out that data breach by French tax authorities in 2024 may be one of the accelerating factors. According to information provided to Cointelegraph, a tax official in the Paris area reportedly leaked personal identification information of French taxpayers and information on cryptocurrency positions. Chainalysis data shows that attacks began to surge in late November of the same year .

research also highlights another incident that occurred in January 2026 , when cryptocurrency tax filing company Waltio disclosed a data breach that affected approximately 50,000 users, which may have broadened the range of high-value target groups that criminals could identify.

除了泄露机制本身，更广泛的政策背景也在辩论之中。加拿大比特币交易所BullBitcoin创始人Francis Pouliot此前曾批评欧洲DAC8报告框架在法国的应用，认为它可能会加剧信息暴露风险。他的观点将这一问题框定为客户尽职调查的反转。

攻击目标超越钱包所有者本人

Chainalysis描述的最具影响力的转变之一是犯罪分子实际寻找的对象。在全球范围内，截至2026年初，亲属和熟人在暴力事件中约占25%至30%。然而在法国，这一比例上升至40%以上。

这种变化可以重塑受害者对风险的认知。如果暴力针对的是家庭成员、伴侣或亲密关联人士，那么持有加密货币的人可能并不是站在攻击者面前的人。

Chainalysis引用了2026年在法国报告的多个例子：

• 2026年5月： 六名男子据称试图从位于法国维勒努瓦的夫妇家中绑架Sébastien Borget的妻子，其中一名袭击者据称伪装成快递员。
• 2026年8月： 一对法国农村夫妇在购买此前由加密货币百万富翁居住的房产后，据称遭遇了三次单独的入室盗窃未遂事件；Chainalysis将此归因于暗网上泄露的税务信息和地址详情。
• 2025年案例：The father of a cryptocurrency entrepreneur was allegedly kidnapped in Paris and held in captivity for two days after the kidnappers allegedly cut off one of his fingers and sent it to his son, demanding a ransom of $5.6 million in cryptocurrency.

Jardine believes that the focus on relatives and related persons suggests that criminals conducted prior reconnaissance -possibly using social media surveillance, blockchain analysis, leaked databases or information obtained from insiders. For users, this reinforces a key difference: If an attacker obtains a "target map" that connects his wallet to real Social networks, protecting the operational security of personal accounts may not be enough.

French response: characterize it as organized crime

French authorities are responding by treating these incidents as organized criminal activities rather than sporadic opportunistic robberies. The investigation is coordinated through JUNALCO, the country's jurisdiction specializing in organized crime.

This is critical because organized crime investigations often focus on the supply chain-that is, how criminals obtain information, gain access to victims, and operate within criminal networks-rather than just chasing down those who commit violence. If the connection to leaked data is as strong as Chainalysis implies, the focus of the investigation may shift to the early stages of the positioning phase.

In addition, Cointelegraph pointed out that the well-known directory of physical cryptocurrency attacks maintained by Bitcoin security advocate Jameson Lopp recorded hundreds of cases across multiple countries between 2014 and 2026, with France ranking first. This historical record highlights the persistence of "wrench attacks" around the world-while France's recent surge highlights the speed with which threats rapidly escalate as access to information improves.

The $5 wrench problem

For many cryptocurrency users, security advice has long focused on preventing system breaches: protecting mnemonics, using hardware wallets, and avoiding phishing traps. But the French case described by Chainalysis and the Interior Ministry turns the perspective to another failure pattern-a pattern that began long before the criminals arrived.

Cryptography can protect funds; but if an attacker already knows who and why to look for and has low-cost coercion, it cannot stop determined attackers. As the number of cases rises, the question facing readers is not just how to strengthen their wallets, but how to reduce the risks of real-world exposure when personal and financial information is leaked, aggregated, or reused.

Looking to the future, investors and users should pay attention to whether French law enforcement operations are increasingly exposing targeted "source layers"-including data breaches, information reselling, and insider recruitment-rather than just arresting perpetrators after violence breaks out. The current uncertainty is whether the current surge reflects lasting structural changes or a temporary acceleration associated with specific exposures in 2024 and 2026.