Cryptocurrency accounts have long been targets of online hacks and scams. But a growing share of crypto thefts now begin in the physical world, where crooks are using face-to-face coercion to steal digital assets, according to a new report.
“Wrench” attacks — the crypto industry’s term for in-person, strong-arm tactics — showed a 33 percent year-over-year increase in the first half of 2026, according to blockchain security audit company CertiK.
Using publicly available information and other verified sources, the company found 52 wrench attacks worldwide through June, up from 39 during the same period in 2025.
CertiK applies the label to incidents of physical coercion, “in which adversaries use violence, intimidation or credible threats to compel a victim to transfer digital assets, surrender private keys, unlock a wallet, reveal credentials, or pressure a third party into compliance.”
The crimes fall into traditional categories, including home invasions, kidnappings and in rare cases, murder. CertiK said that its survey probably undercounts such incidents, given that some victims might not report wrench attacks to authorities, and many aren’t publicly known until investigations are completed.
Even if a threat isn’t face-to-face, the tactics go beyond the usual social engineering associated with break-ins to crypto wallets or platforms.
“Attackers do not need direct access to the primary holder if they can threaten a spouse, parent, child, employee, driver, assistant, or close friend,” the report said. Proxy victims often have weaker operational security, more predictable routines, and less training than the primary target.”
Examples include the kidnapping of a French mother and child in April, a 2025 home invasion in Minnesota and a 2024 case in Connecticut involving a carjacked Lamborghini.
The related losses appear to have ballooned, too, reaching $124 million reported so far this year, compared with $10.5 million reported in the first half of 2025. CertiK advised readers to see those figures, however, as an indicator “of the overall financial scale of wrench attacks rather than a measure of realized criminal profits” because they represent not only funds coerced from victims but also situations where assets might have been frozen.
Security firms and law enforcement have been sounding the alarm about wrench attacks over the last couple of years. Blockchain analysis firm TRM Labs reported on the phenomenon last March, and British trade association CryptoUK hosted a webinar with law enforcement in December.
Researcher Lukasz Olejnik noted in January that wrench attacks leverage when users keep their cryptocurrency in “self custody,” such as in an offline wallet stored at home. In that case, there’s no intermediary, such as a bank, to halt, slow or reverse a transaction.
“Under self-custody, the user is on their own,” he wrote.
Recorded Future
Intelligence Cloud.