Home Invasions Now 41% of Crypto Attacks, CertiK Report Finds

Wrench attacks against cryptocurrency holders got more frequent in the first half of 2026. They also changed shape.

CertiK's H1 2026 report verified 52 attacks worldwide, a 33% increase from 39 in the same period last year. Financial exposure – covering ransom demands, transferred funds, and frozen assets – jumped to roughly $124.1 million, up from $10.5 million a year earlier, the security firm said.

The report's central finding is a tactical shift. Home invasions rose from a single publicly reported case in H1 2025 to 20 in H1 2026, now accounting for about 41% of all verified incidents. Kidnapping, still a significant tactic, rose more modestly, from 12 to 16 cases.

CertiK links the change to improved wallet security. As hardware wallets and cold storage make remote hacking harder, attackers move toward the person holding the keys. A home invasion attacks a victim's entire security perimeter at once – residence, family, device access, and psychological composure – in a way a remote hack cannot, the firm said.

The Data Supply Chain

A major focus of the report is how targets are identified. CertiK highlights a growing "data supply chain" of leaked databases, tax records, exchange data, and social media activity used to build detailed profiles before physical contact. Specific cases cited include a French tax administration employee allegedly selling investor data to criminal networks, and an extortion attempt Kraken disclosed involving malicious insiders in its client-support environment.

The report reframes personal data exposure – not just wallet security – as a physical safety risk.

CertiK describes a layered criminal model behind many attacks: organizers who source victim data and coordinate logistics, and ground-level operators often recruited through messaging apps, some themselves coerced into participating.

France as a Hotspot

Europe accounted for 39 of the 52 incidents, or 75% of the global total. France alone recorded 33 – 63.5% of all verified cases. The US had 4 incidents; Sweden and the UK recorded 2 each.

French authorities have made roughly 200 arrests since January tied to crypto-linked kidnapping and extortion, with several dozen of those arrested identified as minors, the report said.

CertiK attributes France's concentration to its visible crypto ecosystem combined with recent data breaches at institutions like France Travail and ANTS, which may have expanded the pool of identifiable targets.

For individuals, CertiK recommends reducing exposure by removing wallet addresses, portfolio screenshots, home details, and travel plans from public view. It advises separating wallets and securing long-term holdings through multisig or MPC systems, while keeping recovery materials away from signing devices. Families should prepare emergency procedures and avoid carrying sensitive wallet access on everyday devices.

For founders and high-profile holders, the report recommends assessing personal risks and eliminating single-person control over treasuries and critical systems. It also advises verifying meetings, travel, and public appearances, reviewing past online content for leaked personal information, and creating a response plan with legal, security, and custody partners.

CertiK also highlights the need to reduce human points of failure through multi-party controls, limited data exposure, and stronger insider monitoring for institutions and wallet providers. Wallet providers should build in safeguards such as emergency freezes and spending limits, the firm said.

The shift toward home invasions shows that improved on-chain security is pushing attackers to target physical safety instead. French authorities have made roughly 200 arrests since January, several dozen of them minors.