Crypto wrench attacks steal $30M in first half of 2026: Chainalysis

Violent attacks against crypto holders extracted more than $30 million worldwide through late June 2026, according to an Aug. 6 report. 

The firm documented 46 kidnappings, home invasions, hostage situations and related attempts, compared with 40 during the same period in 2025.

The total places 2026 on pace to challenge the record $58 million stolen during 2025. However, Chainalysis said its figures cover reported cases and likely undercount the true scale. Attempted extractions, including blocked transfers, unpaid ransom demands and recovered funds, reached an estimated $107 million during the first half.

Crypto wrench attacks put 2026 on record pace

Only 12 of the 46 documented attempts resulted in payment, producing a 26% success rate. That was down from 49% in 2025 and 67% in 2024, even as the number of known attacks increased.

Chainalysis said 2026 “could become the single-worst year” for violent crypto theft if the first-half pace continues.

The projection is conditional rather than a confirmed year-end outcome. The report covers known cases through late June, and both reporting rates and the size of individual thefts can change sharply during the second half.

While most crypto crime unfolds online, physical violence against holders is accelerating. With $30M already stolen in 2026, “wrench attacks” and home invasions are on pace for a record year, with France emerging as the primary global hotspot. Read our new research for a… pic.twitter.com/ilJiOyJtLy

— Chainalysis (@chainalysis) August 6, 2026

The attack mix also changed. Home invasions represented 37% of incidents, up from 14% in 2025. Kidnappings accounted for 52%. Chainalysis said some cases overlap because an intrusion can develop into detention or forced movement, so classification depends on the dominant outcome.

France’s surge points to data exposure and organized crime

France recorded 30 publicly known cases by midyear, compared with 19 throughout 2025. French authorities have counted a much larger total. The national Gendarmerie said on July 7 that 77 crypto-linked kidnappings and detentions had been recorded since January.

As previously reported in France’s crypto kidnapping crackdown, authorities have expanded intelligence sharing and coordination with digital asset companies. Chainalysis said the French response had produced roughly 200 arrests, 88 indictments and 75 suspects held before trial by midyear.

Official case records show the size of individual investigations. In March, more than 450 officers arrested 18 people over a 2025 kidnapping, with 12 suspects later indicted. Three were placed in pretrial detention and nine under judicial supervision.

In May, authorities detained three additional suspects after a victim was forced to transfer about €68,000 in crypto. One suspect allegedly described being recruited by the DZ Mafia criminal organization. The suspects were indicted and held in pretrial detention, while the investigation remained open.

Chainalysis called compromised personal data the “likeliest culprit” behind the French surge. It cited allegations that a tax official sold dossiers containing investors’ identities, addresses, holdings and tax information. Those claims remain allegations and have not been established by a final judgment.

The report also cited Waltio’s January security breach, which it said affected about 50,000 users. Waltio confirmed unauthorized access to data connected to 2024 tax reports, but said the exposed information excluded names, postal addresses, phone numbers, passwords, wallet addresses, API keys and detailed transaction histories. A direct causal link between that breach and physical attacks has not been proven.

Relatives and homes become bigger targets

Attackers increasingly target people close to crypto holders. Relatives or acquaintances represented about 25% to 30% of documented cases by early 2026, up from almost none in 2021. In France, more than 40% of incidents targeted a relation rather than the holder directly.

In related coverage of a failed family kidnapping, neighbors disrupted an attempt involving the wife of a Sandbox cofounder. Earlier, Ledger cofounder David Balland’s kidnapping showed how attackers may use relatives, executives and public visibility to identify targets.

Most victims were local residents, suggesting prior reconnaissance rather than opportunistic attacks on tourists. Chainalysis said known-residency cases involved locals in 93% of French incidents and 77% of U.S. incidents. It identified the U.S. as a long-running outlier for home invasions.

Onchain trails give investigators leverage

Chainalysis divided attackers into three broad groups based on how they moved stolen assets. Less experienced criminals sent funds directly to centralized exchanges, creating clear compliance and subpoena points. More capable groups used bridges, decentralized exchanges and intermediary wallets to delay identification.

The most advanced cases appeared connected to wider criminal networks and laundering services. One traced flow reached an alleged over-the-counter laundering service that had interacted with cartel-linked wallets, terrorist financing clusters and Southeast Asian laundering networks. These connections describe blockchain exposure, not proof that every connected party participated in the original attack.

The next focus will be whether France’s rapid-alert system, industry coordination and organized-crime prosecutions reduce the attack rate. Investigators will also watch whether centralized exchanges freeze funds quickly and whether cross-chain tracing can identify local crews and their organizers.

For holders, Chainalysis recommended limiting public disclosure of wealth, separating real-world identities from onchain activity and strengthening physical security alongside wallet custody. The report also called for wider blockchain training among frontline police because these cases often begin as conventional kidnappings, home invasions or extortion investigations.