Crypto Wrench Attacks Near Record Pace With $30M Stolen

"Home invasions allow criminals to confront victims in a controlled environment where they can compel a transfer of funds," Chainalysis wrote. "Kidnappings, by contrast, are much more difficult to execute. Attackers must expend considerable time and resources planning logistics; and the extended periods spent with victims leaves the attacker exposed for longer."

France has become the epicenter, recording 30 incidents through mid-2026, more than any other country. Chainalysis said the increase appears linked to an alleged breach involving tax records that exposed information about high-net-worth crypto holders.

The report also found wide differences in how attackers handle stolen funds. Some move assets directly to centralized exchanges without attempting to hide their trail, suggesting a basic understanding of cryptocurrency. Others use more sophisticated methods, including decentralized exchanges, bridges and MEV bots to swap assets across chains.

"Mid-tier attackers demonstrate greater familiarity with crypto infrastructure," Chainalysis wrote. "They understand that centralized exchanges represent chokepoints with sophisticated compliance programs and user KYC, and attempt to avoid or delay interaction with them."

The report follows a string of high-profile cases. French authorities charged 88 suspects, including more than 10 minors, across 12 investigations in April. In June, French authorities indicted a man accused of posing as a police officer in a wrench attack. In July, security firm CertiK said financial exposure from wrench attacks reached $124 million in the first half of 2026. This week, five men were convicted in London of imprisoning and torturing two French crypto millionaires in an extortion scheme.

The 46 attacks recorded through late June put the year on track to surpass 2025's record of 72 incidents.