The wrench attack: when your crypto security is decided at your own front door

Picture this. You’ve spent a fortune fortifying your house. Steel door, night-vision cameras, an alarm that calls the fire brigade if a fly crosses the living room. But one ordinary Tuesday the doorbell rings. It’s a guy in a delivery uniform with a parcel in his hand. You open up. And in that second, your thousands of euros of technology stop being worth anything, because what you’ve got in front of you is not a digital problem. It’s a physical one, and against those the most expensive lock in the world does nothing for you.

In the crypto world that is exactly what has happened to us. We spent years arguing about whether this smart contract was safe or whether that cold wallet was impregnable. And while we stared at the screen, the danger jumped into the real world. They call it a wrench attack. The name comes from an old computing joke: why would you crack a password of hundreds of bits with a supercomputer when for five euros you can buy a wrench and hit the owner until he writes it down for you himself. In 2026 that joke stopped being funny. However good your key is, if someone puts a piece of hardware-store metal in front of your face, you’re going to open the wallet. There’s no cryptography that holds up against that.

The data from the first half of 2026 is not an early warning. It’s the proof that the system broke at its weakest link, which is us.

The end of security by screen

We’ve built a digital fortress on top of mud foundations. The security of the protocols and the wallets has improved so much that criminals no longer find it worth their while to try to crack the software. It’s cheaper and faster to crack the owner. When the safe is too good, the thief stops studying the safe and starts studying whoever holds the combination.

In the first six months of 2026, 52 physical attacks against crypto holders were verified worldwide, according to the report by the security firm CertiK. It may sound like little next to the millions of users out there. But you have to look at what’s inside the box, not at the label. Those 52 attacks put 124.1 million dollars in play. To give you an idea: in the same period the year before, the figure was 10.5 million. The haul multiplied almost twelvefold, while the number of attacks only rose 33%, from 39 to 52.

That gap between the two figures is the important part, and it’s worth stopping on it. If attacks go up by a third but the money stolen multiplies by twelve, it means each hit is far bigger. The average haul per incident went from around 270,000 dollars to 2.39 million. The attackers are no longer going in blind. They’re not robbing anyone who walks down the street in a Bitcoin T-shirt. They’re choosing who to visit with the coldness of someone flipping through a catalogue. And to choose like that, you need information. That’s where the ugly part of this story begins.

They find you because someone sells them the map

A lot of people think these attacks happen because the victim was showing off money on social media. The showing off helps, I won’t deny it. But the real engine of this wave isn’t vanity. It’s the data trade. Someone knows who has it, how much they have and where they live, and that list is paid for.

France is the best place to see the machinery from the inside. Of the 52 attacks worldwide, 33 happened on French soil. That’s more than 60% of the global total concentrated in a single country. Europe as a whole accounted for three out of every four incidents. The question asks itself: why there? It’s not that the French hold more crypto than Americans or Chinese. It’s that their personal data ended up in the dump.

There were massive leaks at official bodies. France Travail, which is the public employment service, and the ANTS portal, which handles identity documents and vehicle registrations, suffered breaches that exposed the data of millions of people. But the most serious part didn’t come from outside. It came from inside the offices. In January 2026 the case of Ghalia C. broke, a French tax administration agent who, according to the investigation, used the tax authority’s own software to look up profiles of crypto investors and then sold those lists, with names and addresses, to criminal networks. Not a sophisticated hack, not a cloud breach. A civil servant with legitimate access and a price.

It’s as if the security guard of your neighbourhood, the one who has a copy of every key and knows what time you leave for work, handed the whole game to a gang of thieves. Once they have your name, your address and know how much you declared last year, the weeks spent hiding in a car watching you are over. They don’t need that any more. They just have to knock on your door one Tuesday morning.

And here’s a detail almost nobody explains. In crypto, a wallet address is public. Anyone can see how much is inside; what they can’t see is whose it is. The whole security of that anonymity depends on nobody linking your name to your on-chain address. The day someone makes that link, with a leak or a corrupt official, your balance stops being an anonymous number on a screen and becomes a concrete amount of money sitting in your house. We’ve written about that seam between the real world and the digital one before on Brújula, in the post on Web3, programmable accounts and tax traceability. The problem is the same as always: your entire security rests on nobody knowing that address is yours, and that’s exactly what has broken.

When your living room is the scene of the robbery

The most brutal change this year is that the danger got inside the house. Robberies used to happen in the street or through trap meetings, that classic of agreeing to buy something and finding three guys waiting. Now the main vector is home invasion. Assaults in homes went from something almost anecdotal, a single public case in the first half of 2025, to 20 incidents in the same period of 2026. From one to twenty. And with them, kidnappings also rose, from 12 to 16, and four cases of torture and one murder were recorded.

Look at what happened to Sillytuna, a video game developer known in the digital collectibles scene. In March 2026 he reported that around 24 million dollars in digital assets had been ripped out of him. He himself described the episode talking about violence, weapons and kidnapping threats. It’s worth being honest about this case, because it isn’t fully settled: part of the sector debates whether it was a pure physical assault or whether there was also an address-poisoning component, a technique where they slip you a fake address similar to the real one so you send the money to the wrong place. CertiK counts it as a physical attack because the victim reported coercion. What is proven, and gives you chills, is the ending: the attacker moved the loot into Monero, a coin designed so it can’t be traced. Translated, the money vanished down a drain that has no cover to look through. The software didn’t fail. The wallet had no hole in it. The hole was in the owner’s private life.

And they don’t always go for the owner directly. Criminals have learned it’s much easier to break a person if you threaten their family. It’s what CertiK calls proximity attacks. According to its report, more than half of the incidents in France this year involved a family member of the target: the partner, a child, an elderly parent, either as a direct victim or as a pressure lever. They’re not looking for you to be brave. They’re counting on you not being able to stand someone else suffering for your money, which is a very different thing and much harder to resist.

The specific cases put a face to the statistic. In February a magistrate and her mother were kidnapped in an attempt to collect a crypto ransom; police freed them after several arrests. In March, in the Le Chesnay area, a couple were forced to transfer around 900,000 euros in bitcoin. In April, in Malaysia, a South Korean national was abducted by attackers demanding ten million in the stablecoin USDT, and they walked away with three. In May, a man showed up disguised as a delivery driver with a cardboard box at the door of the home of Sébastien Borget, co-founder of The Sandbox, and when his wife opened the gate several accomplices tried to force her into a car. The neighbours stopped it. Police found two teenagers carrying a fake handgun, zip ties and balaclavas. The friendly delivery guy from the start of this piece, the one ringing the bell on an ordinary Tuesday, turned out not to be a metaphor.

Fear changes the game

All of this is setting off a domino effect in how people behave. The ones who used to show their faces at conferences or write under their own names in forums are wiping themselves off the map. Public identity, which for years was a signal of trust for doing business, has turned into a target painted on your back. Bragging about getting an investment right went from earning prestige to handing your address to the wrong people.

But the deepest blow lands on the very philosophy of this technology, that idea of being your own bank. It sounds great until you look at it up close. If you keep all your money under a single key you hold at home, you are what engineering calls a single point of failure: if that one piece falls, everything falls. A real bank doesn’t work like that. It has safes with delayed opening, guards, cameras and protocols that stop a single employee, no matter how hard he’s threatened, from handing over all the cash in the branch. It’s designed so that coercion is useless, because not even the person in front of you can give you what you’re asking for even if they wanted to.

Most crypto users have none of that. If a guy points something at you in your own kitchen, you can empty your whole net worth in three minutes from your phone, without calling anyone, without waiting for anyone, without a single obstacle kicking in. That speed, which for years we sold as the great advantage, is now the great weakness. The same feature that lets you send money to the other side of the world in seconds lets them take it from you in seconds. The freedom to move funds instantly and the danger of being forced to move them instantly are the same coin, and there’s no way to keep only the good side.

The limits of what we know

Time to be clear about the numbers, because this is where a lot of articles cheat. The 124 million dollars we’re talking about are only the part that comes to light. They come from verified, public incidents, and below that figure there are many more attacks that never get reported.

Why wouldn’t someone report that a million euros was stolen from them at gunpoint in their own home? Out of fear the robbers come back if they talk to the police, because they know where they live. Out of fear of a problem with the tax office if those funds weren’t fully declared. Or simply out of shame at having fallen for it. On top of that there’s a counting problem: the police themselves sometimes classify these cases as ordinary robberies or home break-ins, without noting that the target was cryptocurrency, and then the attack disappears from the specific statistics even though it happened.

You can see it clearly in a discrepancy of numbers. While the CertiK report counts 33 cases in France, the French Interior Ministry itself has acknowledged up to 77 physical incidents linked to crypto in the same period. The difference isn’t that one is lying and the other telling the truth; it’s the methodology, what each one counts as a verified case. But the message coming out of that spread is the same from both sides: the problem is a lot bigger than what shows up in the news. When someone presents these figures to you as if they were the exact total, be suspicious, because they mark the minimum that could be documented and not the real size of the problem.

How to stop being a target

After seeing how the gangs moved this year, the conclusion leaves no room for decoration: you can’t trust your security to an electronic device. You have to redesign the way you live with this so that coercion is useless to whoever points at you. Four ideas, ordered from easiest to most technical.

1. Shut off the information tap

The data already leaked out there, you’re not going to erase it, forget about that. But you can stop generating new data. Don’t talk about what you hold, don’t show screenshots of your balance, don’t carry your main wallet on the same phone you pull out on the metro. And be very careful with the first step of almost every robbery, which isn’t the wrench but the click: most lootings start on a fake website that imitates a real one so you connect your wallet and sign your own ruin. Before connecting to any site, check that the domain is the genuine one. That’s what Brújula Security is for, a free Chrome extension that analyses every website before you connect your wallet, detects cloned domains and blocks attempts to steal your seed phrase, and does it all inside your browser without any data leaving your machine. Cutting your digital trail and checking where you sign is the cheap part of security, and it’s the one almost nobody does. If you want the full detail, we develop it in the guide to shielding your crypto from scams.

2. Add friction

This is the point that really changes the attacker’s calculation. If someone gets into your house and you can transfer all your funds in five minutes, you’re done. The solution is to use systems where that’s impossible even if you want to. A multisig wallet splits control across several keys kept in different places, so more than one is needed to move the money; if the thief has you, he’s missing the rest. A time lock, or timelock, stops funds being withdrawn until a set period passes, and there’s no human way around it. When the attacker finds out he can’t take the loot right now, the risk of staying in your house waiting goes up and his interest in you collapses. You’ve turned yourself into a bad deal, which is exactly what you want to be.

3. Prepare your people

Because you’ve already seen they go after them. Agree an emergency codeword with your family, one that means I’m in danger without the person in front of you noticing. Set out a clear protocol for when a stranger knocks at the door, especially if they turn up with the perfect excuse of the delivery driver. And think ahead about what gets done if this happens, because in the moment of fear nobody improvises well. These family protocols are worth thinking through together with the plan for what happens to your funds if you’re gone, a subject we cover in the post on inheritance and succession of digital assets.

4. Keep a decoy wallet

An account with a small but believable amount, the one you hand over to whoever is pointing at you so he leaves thinking he’s taken everything. It’s the equivalent of the old wallet with twenty euros some people carry to give the pickpocket. It’s an uncomfortable idea, but it works, and in a coercion situation it can make the difference between losing a part and losing it all. If you come from the DeFi world and want to fine-tune the separation of funds and permissions, the DeFi security guide has the technical part.

The lesson of this 2026 is harsh and I’m not going to soften it. Technology gave us financial freedom, but it stripped away the protection of anonymity and of the structures that cushion the blows in the traditional world. A bank charges you fees and controls you, yes, but it also puts, between your money and an assailant, a wall of delays, employees and protocols that you, alone in your kitchen, don’t have. If you want to keep the freedom, you have to build that wall yourself. Security stopped living only inside the computer. Now it starts at the doormat, in knowing who’s knocking before you open the door.

Sources

• CertiK, Intel3D report on wrench attacks (H1 2026): https://www.certik.com/certik-report/intel3d/intel3d-wrench-h1-2026
• CertiK, 2026 wrench attacks overview: https://www.certik.com/blog/2026-wrench-attacks-overview
• Decrypt, «Crypto ‘Wrench Attacks’ Cost Victims $124M in Six Months, Up 12x: CertiK»: https://decrypt.co/374136/crypto-wrench-attacks-cost-victims-124m-in-six-months-up-12x-certik
• FinanceFeeds, «Crypto wrench attacks $124M France H1 2026»: https://financefeeds.com/crypto-wrench-attacks-124m-france-h1-2026/
• Cryptopolitan, on the wrench attacks in France 2026: https://www.cryptopolitan.com/certik-crypto-wrench-attacks-2026-france/
• Decrypt, attempted kidnapping of Sébastien Borget’s wife (The Sandbox): https://decrypt.co/368631/the-sandbox-co-founders-wife-targeted-in-crypto-kidnapping-attempt-report
• CNN, kidnapping of a magistrate and her mother in France: https://www.cnn.com/2026/02/10/europe/crypto-linked-kidnapping-france-intl
• Protos, Sillytuna case (24 million): https://protos.com/game-developer-sillytuna-reports-losing-24m-of-crypto-in-uk-wrench-attack/