Wrench attack
Using violence, or the threat of it, to make someone hand over their crypto or unlock their wallet. The name comes from a 2009 comic: no encryption stops a 5-dollar wrench.
In February 2009, the webcomic xkcd set a cryptographer’s idea of an attack, an expensive effort to break his laptop’s encryption, next to what “would actually happen”: two men decide to hit him with a 5-dollar wrench until he gives them the password. The name stuck for any attack that goes around the cryptography by going after the person.
With crypto, it means a robbery, a home invasion, a kidnapping or a threat to someone’s family, to get a transfer made, a seed phrase handed over or a wallet unlocked. It works because the network checks only signatures: a transfer made under threat looks like any other, and no one can reverse it. Where one private key moves everything, the person who holds it is all a robber needs.
These attacks are growing. A public list kept on GitHub records 167 in 2025, as of October 2026, more than in any earlier year, and it says itself that many attacks are never reported. In France, the national organized crime prosecutors counted 67 kidnappings and forced confinements tied to crypto in 2025, and more than 70 in the first eight months of 2026. Relatives are targeted too, and so are people who were only thought to hold crypto.
What lowers the risk is being a poor target: saying little about what you hold, keeping your home address out of crypto companies’ records, keeping on your phone only what you could hand over, and keeping savings behind several keys in different places, or a timelock, so that nothing large can be moved on the spot. The guide on wrench attacks has the cases, and what to do if it happens.