Crypto 'wrench attacks' persist as total climbs to 52 and value targeted jumps more than tenfold, CertiK says

While the frequency of crypto "wrench attacks" slowed during the second quarter, incidents continued, bringing the first-half total to 52, CertiK said in a report published Wednesday.

One of the most notable trends so far this year, according to CertiK, is the amount of money stolen or demanded by attackers. Total recorded financial exposure — including ransom demands and stolen funds — rose more than 1,000% year over year, climbing to $124 million from $10.5 million.

As with the firm's last report in May, CertiK pointed out that Western Europe, particularly people in France, have suffered the most attacks.

"Geographically, the threat landscape became highly concentrated. Europe accounted for 39 of 52 verified H1 2026 incidents. France alone accounted for 33 incidents, making it the dominant national epicenter in the dataset," CertiK said.

Wrench attacks refer to physical assaults or extortion used to force victims to surrender their crypto, able to bypass even the most sophisticated of digital security protections. CertiK has described them as an "established threat vector for cryptocurrency holders."

While kidnappings have also increased so far this year, the number of home invasions has skyrocketed.

"Tactically, the defining shift of H1 2026 is the rise of home invasion tied to crypto. Home invasions increased from one publicly reported incident in H1 2025 to 20 in H1 2026," the firm said.

In its detailed report, CertiK recommends limiting public information that connects a person’s identity, location or routine to their crypto holdings. Significant assets should be stored so they cannot be accessed or immediately transferred by one person, with wallets, signing devices and recovery materials kept separate. Holders should also strengthen home security, prepare emergency plans with family members and keep sensitive accounts off devices used while traveling.