A new report indicates a significant rise in "wrench attacks," a term used in the cryptocurrency industry for in-person, strong-arm tactics employed to steal digital assets. Blockchain security audit company CertiK reported a 33 percent year-over-year increase in such incidents during the first half of 2026, identifying 52 attacks globally through June, up from 39 in the same period of 2025.
CertiK defines wrench attacks as incidents of physical coercion where adversaries use violence, intimidation, or credible threats to compel a victim to transfer digital assets, surrender private keys, unlock a wallet, reveal credentials, or pressure a third party into compliance. These crimes often manifest as traditional offenses like home invasions, kidnappings, and, in rare instances, murder.
The company's report suggests that these figures likely undercount the actual number of incidents, as some victims may not report such attacks to authorities, and many remain private until investigations are complete. The tactics extend beyond typical social engineering, even if the threat isn't face-to-face. Attackers may target "proxy victims" such as spouses, parents, children, employees, drivers, assistants, or close friends, who often have weaker operational security, more predictable routines, and less training than the primary target.
Examples cited include the kidnapping of a French mother and child in April, a 2025 home invasion in Minnesota, and a 2024 case in Connecticut involving a carjacked Lamborghini. The financial losses associated with these attacks have also reportedly surged, reaching $124 million so far this year, a substantial increase from the $10.5 million reported in the first half of 2025. CertiK clarifies that these figures represent the overall financial scale of wrench attacks, including funds coerced and assets that may have been frozen, rather than solely realized criminal profits.
Security firms and law enforcement agencies have been raising awareness about wrench attacks for the past couple of years. TRM Labs, a blockchain analysis firm, reported on the phenomenon in March of the previous year, and the British trade association CryptoUK hosted a webinar with law enforcement in December.
Researcher Lukasz Olejnik noted in January that wrench attacks are particularly effective when users maintain "self-custody" of their cryptocurrency, such as in an offline wallet stored at home. In such scenarios, there is no intermediary, like a bank, to halt, slow, or reverse a transaction, leaving the user without institutional protection.
