Chainalysis: Violent Crypto Crime Doubles as Attacks Shift to Homes

Chainalysis has warned that cryptocurrency crime is increasingly moving from online hacks into kidnappings, home invasions and other violent incidents. The blockchain analytics firm's latest report, shared with crypto.news, said criminals are targeting holders who can transfer digital assets immediately under coercion.

Cybercrime still accounts for most illicit crypto activity. The report estimated $3.4 billion stolen through hacks, $17 billion lost to scams and about $820 million linked to ransomware in 2025. Physical attacks have become more common because crypto holders often control large amounts of wealth through self-custody wallets without the institutional safeguards of traditional financial assets, Chainalysis said.

Violent criminals extracted more than $30 million from crypto holders during the first half of 2026 through successful kidnappings, hostage situations and home invasions, the report estimated. If the current pace continues, 2026 would surpass the $58 million stolen during 2025. The estimate covers only publicly reported incidents and likely understates the full scale, the firm said.

Although the number of attacks has increased, criminals are succeeding less often. Only 12 of 46 documented violent theft attempts resulted in victims surrendering funds through late June, producing a 26% success rate compared with 49% in 2025 and 67% in 2024. When failed extortion attempts, blocked transfers and recovered assets are included, the value connected to violent incidents rises to roughly $107 million during the first half of 2026.

Every successful forced transfer also creates a blockchain record that investigators can examine, the report said. Analysts grouped attackers into two broad categories based on how they handled stolen assets. The least experienced offenders typically sent funds directly to centralized exchanges, making compliance teams and law enforcement more likely to identify them. More capable operators used decentralized exchanges, bridges and intermediary wallets to complicate tracing before eventually cashing out. A third category, the report said, consisted of attackers who appeared connected to established criminal networks.

In one investigated case, stolen funds passed through an instant exchange before reaching what analysts described as a suspected over-the-counter laundering service. That service had previous blockchain links to cartel-related laundering services, wallets associated with alleged cocaine trafficker Ryan Wedding, terrorist financing clusters and Southeast Asian money laundering networks. The report presented those links as blockchain exposure rather than proof that every connected entity participated in the original violent crime.

As investigators documented more incidents, the nature of the attacks changed. Kidnappings continued to account for most documented wrench attacks, while home invasions climbed from 14% of incidents in 2025 to 37% through mid-2026. Criminals increasingly use homes because they can pressure victims in familiar surroundings without moving them elsewhere, the report said.

Regional patterns differed. The United States remained an outlier for home invasions, while France experienced a much higher share of kidnapping attempts than other countries tracked in the dataset. France has recorded the highest number of publicly known violent crypto incidents since 2023, with 30 cases reported through mid-2026 after recording 19 during all of 2025, the report said. Interior Minister Laurent Nuñez has said authorities documented more than 70 crypto-related violent incidents and announced a rapid identification and alert system for people considered at risk.

The report pointed to an alleged 2024 theft and sale of tax records belonging to high-net-worth crypto holders as the most likely explanation for the rise in French cases. The dossiers allegedly contained names, addresses, holdings, phone numbers and tax information that could help criminals identify potential victims. It also cited Waltio's January 2026 disclosure that unauthorized access affected data connected to about 50,000 users, while stopping short of establishing a direct causal link between the breach and individual attacks.

French authorities have treated the attacks as organized crime investigations. By mid-2026, the crackdown had resulted in around 200 arrests, 88 indictments, 75 suspects held in pretrial detention and more than a dozen investigations, the report said.

Attackers have increasingly turned to relatives and acquaintances to force victims into handing over digital assets. Family members or close relations accounted for roughly 25% to 30% of documented incidents by early 2026 after being almost absent from recorded cases in 2021, the report said. In France, more than 40% of incidents involved someone connected to the holder rather than the holder directly.

Most victims were local residents instead of visitors. Known residency data showed locals accounted for all documented victims in Sweden, 93% in France, 82% in Brazil and 77% in the United States, a pattern that the firm said points to advance reconnaissance using leaked information, blockchain activity, social media or insider knowledge.

Separately, Galaxy Research estimated that confirmed losses from the Coldcard hardware wallet vulnerability had reached 1,596 Bitcoin across three attack waves, with a suspected fourth wave potentially lifting total losses to about 2,055 BTC if verified. The Coldcard incident involved a software flaw rather than physical violence, but it highlighted the value of cryptocurrency that criminals continue targeting through both digital exploits and real-world attacks.