Chainalysis: More than $30 million was stolen due to cryptocurrency "wrench attack" in 2026

Violent robberies against cryptocurrency holders surge

According to Chainalysis's latest report,"wrench attacks" against cryptocurrency holders-that is, forcing victims to hand over digital assets through methods such as kidnapping, home robberies and hostage-taking-are intensifying. In the first half of this year, criminals stole more than $30 million through these violent robberies, making the amount stolen throughout 2026 expected to exceed the record of $58 million set in 2025.

Chainalysis stated that as of the end of June, a total of 46 violent incidents related to cryptocurrency had been recorded globally, compared with 40 incidents in the same period in 2025. The report highlights a key shift in the field of cryptocurrency security: risks are no longer limited to custody and account access, but increasingly extend to the safety of victims 'families, families and personal lives.

Key Data

In the first half of 2026, more than $30 million was reported stolen in a "wrench attack", which means that the amount stolen throughout the year may exceed the $58 million in 2025. As of the end of June, a total of 46 incidents were recorded globally, compared with 40 incidents in the same period in 2025. Payment results remain limited: only 12 of the 46 attacks resulted in payments, with a success rate of 26%. Success rates appear to have declined: The reported payment rate dropped to 26% from 49% in 2025. France is a hot spot: Reports show that as of mid-year, there were 30 public incidents in France, compared with 19 in all of 2025.

Violence increases, but payment rates fall

Chainalysis's data shows that "wrench attacks" have become more frequent, although the proportion of incidents that ultimately lead to payments has dropped. Analysis found that of the 46 incidents recorded as of the end of June, only 12 ended with the attacker receiving payment, with a success rate of 26%. This rate is lower than in 2025, when Chainalysis reported a 49% success rate for similar incidents. This difference is significant to investors and users because it means that criminals may be increasing the number of attacks to make up for lower yields, and even if the probability of a single attack being successful decreases, the overall harm is still increasing.

At the same time, Chainalysis warns that the actual scale may be underestimated. The company noted that many attacks may go unreported, which means that measured success rates may be distorted by incomplete visibility of the results.

report also describes a worrying mode of operation: "Violence is often carried out in amateurs, but the front and back ends are quite professional." In other words, some attackers who execute physical threats may not appear sophisticated, while target selection and planning may be more systematic-often involving victims identified through data breaches, social media or inside information.

The role of the surge in incidents in France and data breach or abuse

Although the "wrench attack" is global, reports show that incidents are particularly concentrated in France. Chainalysis said that as of mid-year, there had been 30 publicly known incidents in France, compared with 19 incidents for all of 2025. Crucially, Chainalysis also pointed out that the visible number may be only a small fraction of the true total: French authorities have reported counting more than 70 incidents.

In July this year, French Interior Minister Laurent Nunez set the data for the first half of the year at 77 incidents of kidnapping, extortion or attempted extortion, compared with 45 incidents for the whole of 2025. Spain's arrest of suspects suspected of kidnapping Ledger's co-founder in 2025 has nothing to do with French statistics, but it highlights how closely jurisdictions pay attention to reported incidents.

According to the report, the French government's response includes establishing a rapid alert and protection system and committing to expand intelligence sharing and coordination with the cryptocurrency industry. For investors, this means regulators and law enforcement are viewing personal attacks as a broader security issue, rather than just an isolated pattern of crime.

Chainalysis also pointed to the most likely driver of the surge in incidents: the alleged misuse of French tax records. The report said there were allegations that a French tax official obtained and sold information about cryptocurrency investors to criminals. In addition, the report also mentioned that another data breach occurred at cryptocurrency tax filing company Waltiot, which allegedly exposed the data of approximately 50,000 users.

For cryptocurrency holders, these details highlight why personal data hygiene and source integrity are increasingly security-related. If criminals are able to identify possible cryptocurrency owners through prior information, the risk of attack may increase regardless of whether the victim's tokens are securely stored in a regular wallet.

The flow of stolen funds after violence

Chainalysis's report also looks at what happens after the physical threat-specifically, how attackers turn coercion into on-chain value. The company said strategies vary in different cases.

In some incidents, attackers allegedly sent stolen funds directly to a centralized exchange. Other attackers used a range of tools and platforms, including cross-chain bridges, decentralized exchanges and money laundering services. Chainalysis noted that the most complex cases show links to broader criminal networks, suggesting violence is only part of an entire ecosystem that may also include professional financial ancillary services.

This multi-stage behavior is important for readers trying to understand risks and recovery possibilities. Even if the physical event does not ultimately result in a payment, the attack attempt itself may be based on data collection and may subsequently employ financial operating processes designed to reduce traceability.

Previous industry discussions have also focused on how hardware wallet vulnerabilities and operational security lapses can lead to theft of the holder. However, Chainalysis's analysis of "wrench attacks" is different: it focuses on physical coercion and the data channels used to identify victims, rather than whether specific device types are generally insecure.

For those who follow broader security trends, the "wrench attack" model is best understood as an extension of cybercrime's harm to the real world-in which data breaches and compromised records help criminals choose targets, while execution methods range from amateur violence to more professional fund transfers.

Follow-up Focus

As reports continue to be released and law enforcement agencies in high-risk areas improve alerting, protection and data sharing, a key uncertainty is whether a decline in payment success rates will translate into a decrease in the total number of victims, or whether attackers will continue to increase the number of attacks to maintain revenue. Cryptocurrency holders should also focus on further disclosures about the pathways of data exposure, especially personal records that may make individuals easier to target.