
Chainalysis counts 46 attacks on crypto holders in H1 2026, with $30M lost. France leads with 30 incidents; the concentration may trace to a tax-data leak.
Physical assaults on holders of digital assets produced more than $30 million in losses in the first half of 2026, according to a new Chainalysis report. The blockchain analysis firm counted 46 attacks through the end of June, most of them kidnappings and home burglaries.
The most frequent type of assault remains kidnapping, the report said. Burglaries are closing the gap. They accounted for 37% of documented incidents in the first half of 2026, up from 26% in 2023. Home intrusions give criminals a controlled environment in which to force a transfer, the report said. Kidnappings demand more planning and more people, and they expose the group to a longer window of risk.
The appeal, the report said, is the asset itself. Crypto moves quickly and irreversibly once a victim yields under duress, unlike money in a bank account. Hostage-taking appears in the tally alongside the kidnappings, with the same goal of forcing an immediate transfer of assets. Chainalysis said attackers now favor setups in which they can control the victim before gaining access to the wallet. Holders become more attractive targets than owners of traditional accounts, Chainalysis said.
The report also flagged a newer pattern. Attackers are pulling relatives and acquaintances of crypto holders into the coercion, using that relationship as leverage to force a faster handover.
France is the center of the trend. The report counts 30 of the 46 incidents there, more than any other country. Chainalysis said the concentration may trace back to an alleged leak of French tax data that exposed wealthy crypto holders, making it easier for gangs focused on assault and extortion to identify targets.
French authorities have responded with arrests. They charged 88 suspects, more than 10 of them minors, across 12 investigations into organized gangs in April, the report said. In June, a man was indicted after posing as a police officer in a "wrench" attack, the term for an assault that forces a victim to unlock a wallet and transfer funds under the threat of violence.
The report splits the people behind these attacks into two groups by how they move stolen funds. The split, it said, comes down to skill.
Less sophisticated criminals have limited knowledge of the crypto ecosystem and send assets straight to centralized exchanges, a method that leaves more traces and raises the risk of identification. Better-resourced groups route funds through decentralized exchanges, cross-chain bridges, MEV bots, and DeFi tools, shifting assets across multiple networks. Those groups, Chainalysis said, deliberately avoid centralized platforms, aware of the compliance procedures and identity checks those services run. They want to limit the chance that funds get blocked or diverted.
The pattern has spread beyond Europe. In the United States, ransom demands requesting payment in bitcoin drew attention during the investigation into the kidnapping of Nancy Guthrie, mother of television host Savannah Guthrie, the report said.
Separately, five men were sentenced in London for kidnapping and torturing two French millionaires in the crypto sector to extort their digital assets, the report said.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.