Crypto Wrench Attacks Cost $124M in H1 2026, CertiK Says

CertiK also described an increasingly professional, layered model, with organizers who buy data and coordinate logistics sitting above disposable, often young operators recruited on messaging apps. Crews now assemble "target packages" from leaked databases, exchange records, and on-chain activity, making data minimization, the firm argues, a physical-safety measure.

It is also reshaping security advice. A hardware wallet or hidden seed phrase offers little protection, CertiK noted, if the owner can be forced to unlock it – pushing the firm to recommend multi-signature setups and withdrawal delays, and to flag family duress protocols as a defense.

The report illustrates an ongoing trend of escalation, with wrench attacks continuing to climb year-on-year. CertiK previously recorded 72 attacks across all of 2025, a 75% jump on 2024, in a year whose most harrowing case was the January kidnapping of Ledger co-founder David Balland and his wife in France, with their captors severing one of Balland's fingers to force a multi-million-euro ransom before police freed them.

The targeting of relatives has become a signature of the French wave. In February, authorities arrested six, including a minor, after a magistrate and her mother were abducted in a crypto ransom attempt. Months later, two teenagers were charged with attempting to abduct the wife of The Sandbox co-founder Sébastien Borget outside Paris using a fake handgun and restraints, until neighbors intervened and forced them to flee.

The scale has drawn a sweeping response. By April, French prosecutors had charged 88 suspects – more than 10 of them minors – across 12 investigations, with French ministers vowing to tackle the issue with measures to protect crypto holders, including check-ups at executives' homes.