The Wrench Attack Epidemic: When They Come for Your Keys

On 21 January 2025, armed men took David Balland, a co-founder of the French hardware wallet maker Ledger, and his partner from their home in the Cher region of central France. They demanded a ransom in cryptocurrency from another Ledger co-founder and, according to Reuters, cut off one of Balland's fingers. The elite GIGN police unit freed him the next day and his partner the day after.

It was the most famous case of what the crypto industry calls a wrench attack, and it was the start of the worst year on record. The name comes from a 2009 xkcd comic: two cryptographers dream of cracking a laptop's encryption with a supercomputer, while a realist notes that the owner will hand over the password after a beating with a $5 wrench. The point of the joke is the point of the crime. Crypto security can be perfect and still fail, because the weakest part is the person holding the password.

The numbers

The blockchain security firm CertiK verified 72 wrench attacks worldwide in 2025, up 75% from 41 in 2024, with confirmed losses of $40.9 million, up 44%. Its report, published in February 2026, counted only cases that were publicly reported and could be checked, and said the true figure was almost certainly higher, because many victims settle quietly. France had the most, with 19 confirmed cases, more than the United States. Europe accounted for about 40% of the total, and kidnapping was the most common method, with 25 cases.

Jameson Lopp, chief security officer at the bitcoin custody firm Casa, has kept a public log of physical attacks on crypto holders for a decade. The Block reported that he recorded about 70 in 2025, the highest annual total in the log. Alena Vranova, founder of SatoshiLabs, which makes the Trezor wallet, said in August 2025 that a bitcoin holder was being kidnapped, tortured or extorted roughly every week.

The next year was worse. CertiK's report for the first half of 2026 verified 52 attacks, against 39 in the same months of 2025. France accounted for 33 of them. Home invasions, almost unknown a year earlier, became the most common method, rising from one case to 20. CertiK put the money at stake at about $124.1 million, against $10.5 million a year earlier, and warned that the figure was indicative rather than complete.

Why crypto invites the wrench

A share trader whose broker is robbed is usually made whole by the broker or by investor protection schemes. Crypto held in self-custody works differently. The coins are controlled by a private key, a long secret password, often stored on a small hardware device such as a Ledger or a Trezor. Whoever has the key can send the coins anywhere in the world in minutes. There is no bank to call, no transfer to reverse and, once the money is swapped into privacy coins such as Monero, often no trail to follow.

That makes a crypto holder a bit like someone who keeps a fortune in cash at home, with one difference: blockchains are public, and anyone who can link a name to a wallet can see roughly how much it holds. Attackers find targets through social media boasts, conference appearances and, increasingly, leaked customer data from exchanges and other crypto businesses. In the United States, the January 2026 disappearance of Nancy Guthrie, the 84-year-old mother of NBC presenter Savannah Guthrie, from her home near Tucson, followed by notes demanding $6 million in bitcoin, raised fears that relatives of well-known people could become targets too. The sheriff said it was unclear whether she had been chosen deliberately. She is still missing.

The cases behind the counts

May 2025 showed how fast the attacks were spreading. On 1 May, the father of a French crypto entrepreneur was snatched in Paris and held for ransom. Police freed him in a night raid on a house in the Essonne region two days later, and French media reported that his captors had cut off one of his fingers. On 13 May, masked men tried to force the daughter of Pierre Noizat, chief executive of the French crypto exchange Paymium, and her young son into a van in broad daylight in Paris's 11th district. She fought them off, a passer-by joined in with a fire extinguisher, and the attackers fled. By 31 May French prosecutors had charged 25 people, six of them minors, over the wave.

The same month, in New York, an Italian crypto investor was allegedly held captive for more than two weeks in a rented townhouse in Manhattan's SoHo district and tortured to give up his bitcoin password before he escaped. Two men, John Woeltz and William Duplessie, were indicted on charges including kidnapping and assault. They pleaded not guilty in June 2025, and their lawyers dispute the account. No verdict had been reported by October 2026.

In October 2025, Roman and Anna Novak, a Russian couple living in Dubai, disappeared after going to meet "investors" in the Hatta hills. Russian investigators say they were killed when the wallet their captors forced open proved to be empty; three men were charged with murder in Russia. On 26 November 2025, a 21-year-old Ukrainian student was found dead in his burned-out car in Vienna's Donaustadt district. Ukrainian court documents citing the Austrian investigation said his attackers had forced him to transfer money from his crypto wallets. Two suspects, aged 19 and 45, were arrested in Ukraine. In March 2026 a longtime crypto figure known online as Sillytuna was forced by four armed men, in his home in the United Kingdom, to send about $24 million.

France becomes the centre

By 2026 France was the world's hotspot. On 30 June 2026, Interior Minister Laurent Nuñez said police had recorded 77 kidnappings, sequestrations, extortions or attempts linked to crypto since January, and that about 200 people had been arrested. In April 2026 the national organised crime prosecutor's office had announced charges against 88 people, more than ten of them minors, across twelve investigations. Investigators describe a two-layer structure: young, cheaply paid crews recruited on Telegram and Snapchat do the physical work, while organisers based abroad buy leaked data, choose targets and launder the proceeds.

Figures the Interior Ministry gave to Cointelegraph counted 90 crypto-linked kidnappings, extortions, threats and violent robberies between January and mid-August 2026, roughly one every two and a half days, with 223 arrests and 126 people jailed. The ministry only began recording the category in January 2026, so there is no official comparison with earlier years.

The industry's answers remain partial. Security advisers tell holders not to discuss their wealth in public. Security researchers have proposed "panic" wallets that show a decoy balance or call for help when the owner is under duress. Insurers in France have revived kidnap and ransom cover for crypto holders. None of it changes the arithmetic behind the xkcd joke: a password protected by mathematics is still known by a person.