Wrench attacks: how to stay safe if you hold crypto

In February 2009, the webcomic xkcd drew two versions of an attack on an encrypted laptop. In the one its owner imagines, the attackers give up against the encryption. In the one that “would actually happen”, they hit him with a 5-dollar wrench until he tells them the password. The name stuck: a wrench attack gets the secret by force instead of by breaking the code.

Crypto suits that kind of robber. It can be sent anywhere from a phone in minutes, a transfer can’t be called back, and in most wallets one key moves everything, so the person who holds it is all a robber needs.

How often it happens

No one has a full count: many attacks are never reported, and each count is made differently. All point the same way.

• A public list kept on GitHub, built from public reports of physical attacks on people and companies that hold crypto, records 69 in 2023, 104 in 2024 and 167 in 2025, and 133 in 2026 up to October 22. It keeps growing after the fact: in January 2026, it showed about 70 for 2025.
• CertiK, a security company that counts only the attacks it could verify, found 72 in 2025, 75% more than in 2024, and more than 40.9 million dollars taken, a figure it says understates the losses. More than 40% were in Europe, and France had more than any other country, the United States included.
• France’s organized crime prosecutors counted about 20 kidnappings and forced confinements tied to crypto in France in 2024, 67 in 2025 and more than 70 in the first eight months of 2026. For France in 2025, the public list, which depends on what reaches the press, has 25.

What happened in France

• January 2025. A co-founder of a hardware wallet company and his partner were taken from their home in central France. The kidnappers cut off one of his fingers and sent a video of it to another co-founder with a ransom demand. About 230 police and gendarmes freed him the next day, and his partner was found tied up in a car. Part of the ransom had been paid in crypto; most of it was seized and frozen. Ten people were arrested within days.
• May 2025. In Paris, in daylight, four masked men pushed the father of a man who had made his fortune in crypto into a delivery van. They cut off one of his fingers and demanded millions of euros from his son. Police freed him two days later, and six people were charged.
• Less than two weeks later, masked men tried to drag the daughter of the head of a French crypto exchange, and her son, into a van on a Paris street. She and her husband held on to each other, and a shopkeeper armed with a fire extinguisher helped drive the attackers off. By June, 25 people had been charged over the attempts that spring, six of them minors; the suspects in the Paris attempt were 16 to 23 years old.

The government then offered crypto entrepreneurs and their families security briefings by elite police units, priority access to emergency services and checks of their homes’ security. The attacks went on: the prosecutors’ count for the first eight months of 2026 had already passed the whole of 2025, and more than 90 people had been charged in their cases alone.

Who gets targeted

Not only the rich or the well known. Attackers go after whoever they believe holds crypto, and whoever is close to that person.

• Relatives. Two of the three attacks above went after a parent or a child of the person with the money.
• People who hold none. In June and July 2026, three teams in turn came for a young couple in the Somme, in northern France. The first turned back at their dogs, the second tied one of them up and beat the other, and the third fled when the alarm they had since installed went off. They held no crypto. According to their lawyer, the tax assessment of the house’s previous owners, retirees who did, had leaked online with its address. In August, a court in Amiens sentenced two men from the third team, aged 20 and 21, to three years and to 18 months, half of each suspended. The couple want to sell the house.
• Whoever is named in a tip. In January 2026, in Scottsdale, Arizona, two high school students aged 16 and 17, dressed as delivery workers, forced their way into a house, tied up a couple with duct tape and beat them, demanding crypto: 66 million dollars of it, according to a prosecutor. People they knew only by aliases on a messaging app had given them the address and 1,000 dollars for supplies. When one of the victims said they had no crypto, the beating reportedly got worse; one of them later told the court he’d had a concussion and a broken rib. An adult son elsewhere in the house called the police, and both students were charged with kidnapping and assault, to be tried as adults.

The people at the door are often young recruits, hired online by someone who stays out of sight: one of the men sentenced in the Somme had been recruited on Telegram to open the door, and the other was paid 300 euros to drive.

How attackers find their targets

An attack needs two facts: that you hold crypto, and where to find you. Both leak in ordinary ways.

• Customer records. Companies that sell you a device or hold your account know your name and usually your address, and their records leak. Hardware wallet makers and the companies they work with have leaked buyers’ names and home addresses again and again, as the guide on hardware wallets, multisig and collaborative custody sets out; after one of those leaks, in 2020, a customer reported a call from someone who had their details and threatened to come to their home and kidnap them. In May 2025, a large US exchange disclosed that criminals had paid members of its support staff outside the United States to copy customer records, with names, addresses, ID images and balances. In January 2026, hackers took the email addresses of customers of Waltio, a French crypto tax service, with the gains and losses from their 2024 tax reports: 50,000 customers, according to Le Parisien. That month, French officials warned that people posing as police officers, bank fraud teams and crypto companies were contacting those whose data had leaked, after their recovery words and devices, and that kidnappings were still being reported.
• Their email, and their street. Before the attack in Durham described below, the crew broke into the couple’s email account and watched their house for several days.
• What people show. French police sum up their advice in one line: “discretion is a protection.” Their spokesperson advised against posting gains on social media, taking screenshots of a wallet and showing off a high standard of living, which draws criminals’ attention. A security researcher interviewed by The Block blamed many attacks on poor privacy, such as people “flexing their net worth in group chats”, and on companies’ data breaches.

A robber at the door wants speed

Someone at your door wants the money moved before anyone notices. In April 2023, in Durham, North Carolina, two gunmen tied up a couple with plastic cable ties, assaulted them and forced the husband to log in to his account at a US exchange, and an accomplice moved more than 150,000 dollars out remotely. A fourth transfer didn’t go through: the exchange refused it as suspicious. The leader of the crew was convicted in June 2024 and sentenced to 47 years in prison. According to the US Department of Justice, he and his accomplices had taken more than 3.5 million dollars from victims in several states, through home invasions and SIM swaps.

That refused transfer is the point: the question to ask of every place you keep money is what someone could make you move from your home, in an hour.

Where the money is	What someone at your door can make you move	What can slow them down
A wallet on your phone	Everything in it, in minutes	Nothing, once the phone is unlocked
An account on an exchange	What the exchange lets out at once	The exchange’s checks on unusual withdrawals
A hardware wallet, or its seed phrase, at home	Everything	Nothing
A multisig wallet with every key at home	Everything: you can be made to use each key	Nothing
Keys kept in different places, or a delay on large amounts	What your limits allow at once	Time, and the other keyholders

What helps

Say less

The French interior ministry’s advice to crypto holders starts there: keep your holdings and your wallet addresses to yourself, especially on social media; don’t talk about your crypto in your personal life; check photos and screenshots for a balance, a username or an email address before sharing them; and remember that crypto events and public places tell strangers things about you. It applies to the people close to you, since they’re targets too.

Keep your address out of crypto records

You can’t stop every company that knows you from leaking, but you can give fewer of them your home address. Don’t have a hardware wallet, or anything else that says crypto, delivered to your home: use a pickup point or a post office box, and an email address you use for nothing else. Treat any call, message or visit about your crypto from someone claiming to be the police, your exchange or a courier as a scam until you’ve checked it through a number you found yourself. French officials point out that the police never call to ask for confidential information; the guide on crypto scams shows how these approaches work.

Keep on your phone only what you could hand over

A wallet on your phone is for spending money, what you’d carry in cash, because it’s what someone can make you send in minutes. Swiss crime prevention advice on robbery says the same of cash: carry only small sums. Security experts interviewed by The Block gave the crypto version: keep everyday wallets apart from long-term savings.

Put savings behind more than one key, or a delay

The French interior ministry suggests two ways: a delay, so that funds unlock only after a set time, and a multisig wallet that several trusted people unlock together. French police also advise a delay on large sums. “You can’t have direct access to long-term funds,” a security specialist told The Block, proposing three keys, any two of which sign, and a 72-hour timelock.

Either way, it works only if no one, you included, can move the money at once:

• Keys kept together at home don’t help: whoever gets to you can make you use each one.
• Keys held by other people put those people in the picture too. French guidance asks the family of someone kidnapped to tell the police who else holds a key, because they may be targeted too.
• A delay has to cover every way out. A timelock on one path does nothing if your own key can still move everything by itself.

For savings, collaborative custody that passes the test in the guide on hardware wallets, multisig and collaborative custody does this without your holding every key.

Agree on a plan

The French ministry also advises preparing for theft, extortion or kidnapping in advance, including how you’d reach your money under pressure. Agree with the people close to you on who calls whom, and make sure someone you trust knows which wallets and accounts exist, without the secrets, so they can tell the police where to look.

If it happens

• Your safety comes first. Don’t resist. Crime prevention advice for any robbery applies: stay calm, keep your hands where they can be seen, make no sudden moves, and make it clear you’re doing what you’re told.
• Call the police as soon as it’s safe, and at once if someone close to you is being held for ransom. French guidance asks you to note which wallets and accounts are involved and, for a multisig wallet, who else holds a key. Payments can sometimes be traced: in the kidnapping of January 2025, most of the ransom paid in crypto was seized and frozen.
• Afterwards, move what’s left to new keys: assume the attackers know your words and your addresses.

What to do

• Say less about what you hold, online and off, and ask the people close to you to do the same.
• Keep your home address out of crypto records: nothing crypto-related delivered home, and suspicion of any call about your crypto that you didn’t start.
• Keep on your phone only spending money, what you could hand over.
• Keep savings where no one can move them on the spot, behind keys in different places, or a delay that covers every way out.
• Agree on a plan with your family before you need one.
• If it happens, hand it over, and call the police as soon as you safely can.