France's Wrench Attack Crackdown: 88 Indicted, Including Minors

France just charged 88 people, including ten minors, in the global crypto kidnapping epidemic. The country has become the wrench attack capital of the world.

On April 25, 2026, France's National Organized Crime Prosecutor's Office (PNACO) announced indictments against 88 people in connection with crypto-related kidnappings, extortions, and home invasions. Seventy-five of the accused are in pre-trial detention. More than ten of the indicted are minors. The charges - kidnapping, unlawful confinement, extortion, and money laundering in an organized criminal setting - cover twelve active judicial investigations. France, which had been notable in crypto-crime statistics mainly for the Ledger data breach and a few high-profile kidnappings, has now become the global capital of wrench attacks.

A wrench attack, in industry slang, is what happens when someone targets a cryptocurrency holder physically rather than digitally. The term comes from a popular xkcd comic that mocks the idea of unbreakable cryptography by pointing out that an attacker with a wrench and a basement is more efficient than a hash collision. In practice, wrench attacks involve abduction, home invasion, threats against family members, and physical coercion to force the victim to transfer crypto. The attacks have surged globally since 2023, but France has become the standout.

The numbers are stark. French law enforcement has recorded 135 crypto-related incidents since 2023, including 18 in 2024, 67 in 2025, and 47 already in 2026. April-month attacks averaged roughly twelve. If the rate continues, France will close 2026 with the highest annual total of any country, by a wide margin. Vanessa Perrée, the French Ministry of Justice's National Prosecutor for Organized Crime, described the perpetrators as "structured criminal networks" - a deliberate phrasing meant to push prosecutors away from charging individuals as one-off offenders and toward organized-crime statutes that carry heavier penalties.

The structure PNACO has documented is two-layered. The ground level consists of small operational teams - typically three to five people, predominantly male, ranging in age from 16 to 50. They are recruited from peripheral urban areas, usually through encrypted messaging on Telegram and Snapchat. Many are inexperienced criminals paid relatively small amounts to carry out the kidnappings, assaults, or home invasions. They follow scripts. They are disposable.

The orchestration layer sits abroad. Organizers and financiers operate from Morocco, Dubai, Eastern Europe, and other jurisdictions outside European law enforcement reach. They purchase data lists from breaches - exchange leaks, KYC compromises, dating-app dumps - and use them to identify high-value targets. They commission coordinators in France to pick local crews. They receive the funds after a successful extortion and handle the laundering chain. The ground crews never know their bosses by face. The orchestrators never set foot in France.

Early 2026 marks a shift PNACO investigators have flagged as particularly worrying: data-driven targeting. Pre-2026 wrench attacks typically required prior physical surveillance to identify the target's residence and routine. In 2026, that surveillance step has become unnecessary. With access to leaked KYC data, attackers already have the victim's full legal name, residential address, family relationships, and approximate financial profile. Data is the surveillance. The Waltio crypto-tax-firm breach disclosed in January 2026 has been directly linked to multiple subsequent kidnappings. Customers whose data leaked from that breach started getting targeted within weeks.

The minor problem is the most disturbing finding. The growing proportion of minors among ground-crew operators is a deliberate criminal-strategy adaptation. Minors in France face shorter sentences and limited adult prison time. Organizers know this. Recruiting 16- to 17-year-olds for kidnapping work pushes the criminal liability away from the network's profitable members and onto disposable youth. Of the 88 indicted, more than ten are minors. Some are 16. The youngest defendants will face French juvenile justice, which means brief detention rather than the long sentences appropriate to the crime.

The proximate cause of France's emergence as the global hotspot is a combination of three factors. France has a large concentration of crypto-natives - early adopters, Ledger employees, indie game developers, retail traders - who concentrated wealth during the 2024 bull run. France also has organized-crime networks willing to add crypto extortion to their portfolio. And France has porous borders to the laundering jurisdictions where the orchestrators sit. The combination produces a target-rich environment with operational ease.

The high-profile attacks of the last 18 months have read like a horror catalogue. David Balland, co-founder of hardware wallet company Ledger, was abducted with his partner in January 2025. Their captors cut off one of his fingers and sent the video to Ledger CEO Pascal Gauthier. They survived. The kidnappers were caught. Multiple French crypto figures have since been targeted, with some declining to publicize the events.

The Sillytuna case in March 2026 - though that attack happened in the UK - became a touchstone for the entire epidemic. The longtime crypto figure and indie game developer was forced to hand over approximately $24 million in aEthUSDC. Four assailants. Weapons. Threats of kidnapping and rape. He was held down. Funds were rapidly laundered into Monero. The attacks targeting French residents have been similar in operational style.

French law enforcement has been criticized for slow response and minimal sentencing in earlier cases. The PNACO indictment announcement is partly a response to that criticism. Prosecutors are signaling they will use organized-crime statutes - which carry mandatory minimums and longer maximums - rather than charging individual offenses. This raises the floor for sentencing significantly. Whether judges follow through is the open question.

Where does the money go after the attacks? Patterns are now well-documented. Stolen crypto is moved rapidly through chains of swaps, often with explicit conversion to Monero, to break visibility. Some funds reach Russian payment processors and Eastern European OTC desks. Some are exchanged for cash through compromised foreign bank accounts. Recovery for victims is rare. Insurance for crypto holders has become a growth industry as a direct response - companies in the EU, US, and Asia are now writing policies specifically for "physical attack" coverage, with premium rates calibrated to disclosed holdings.

For French crypto-natives, the practical effect is a permanent change in operational security. Public X profiles are being scrubbed. Twitter handles tied to wallets are being abandoned. KYC information at exchanges is now treated as a target waiting to be breached. Some Paris-based crypto figures have relocated to Dubai or Switzerland for security reasons - ironically, in some cases, to the same jurisdictions where their attackers' organizers are based.