Violent Crypto Thefts Surge 11.8x to $124M in H1 2026

Physical crypto thefts involving coercion nearly tripled in count and multiplied elevenfold in dollar value during the first half of 2026. CertiK's Intel3D Wrench Attacks report for H1 2026 verified 52 incidents, up from 39 a year earlier, a 33.3% increase. Recorded financial exposure tied to those attacks hit $124,180,400, compared with $10,532,242 in H1 2025 – a jump of roughly 1,079%, CertiK said.

The surge in dollar value per incident marks a shift. It is not just more attacks; the average haul per verified event rose from about $270,000 to roughly $2.4 million. CertiK, a blockchain security firm, tracks only confirmed cases where victims were physically forced to transfer crypto assets, so the figures likely undercount the total. But the direction is clear: attackers are chasing bigger targets.

Chainalysis, the blockchain analytics company, has flagged a growing overlap between crypto and violent crime. In its 2026 Crypto Crime Report introduction, Chainalysis said illicit cryptocurrency addresses received at least $154 billion in 2025. It also documented a correlation between wrench attacks and bitcoin price movements, though it stopped short of calling the relationship causal.

Stablecoins now account for 84% of all illicit transaction volume, Chainalysis reported. While that data covers overall crypto crime – not just wrench attacks – the dominance of liquid, widely accepted stablecoins likely simplifies the economics for physical attackers. A victim coerced into transferring USDC or USDT can move value that is immediately usable, without the price volatility or exchange friction of bitcoin.

The broader risk environment remained elevated through 2025. Chainalysis' mid-year 2025 update noted more than $2.17 billion stolen from cryptocurrency services in that year alone, covering both cyber thefts and physical coercion. The pattern suggests that as crypto asset values climb – bitcoin traded above $100,000 for stretches of 2025 and early 2026 – self-custodied holdings become more attractive to violent criminals.

CertiK's H1 2026 report does not specify recovery rates or the share of incidents that led to arrests. It defines "recorded exposure" as the dollar value of assets confirmed transferred under duress in verified cases, not the total amount attempted or threatened. That means even the $124 million figure is a floor, not a ceiling.