CertiK Counted 52 Wrench Attacks in 6 Months as Home Invasion Becomes the Leading Vector

What Happened

The security firm CertiK published its H1 2026 Wrench Attacks Report this week, and the numbers describe a threat that has changed character, not just size. CertiK verified 52 physical-coercion incidents against crypto holders worldwide in the first half of 2026, a 33.3% increase over the 39 it verified in the first half of 2025.

Recorded financial exposure across those incidents reached $124.1 million, up from $10.5 million a year earlier, an increase the firm put at 1,079%. A wrench attack (the security community's term, taken from the XKCD comic observing that a $5 wrench beats expensive cryptanalysis) is any attack that coerces a holder through physical force or its threat into surrendering cryptocurrency, private keys, or wallet credentials.

CertiK is careful with its framing: the dollar figures are 'indicative, not exhaustive,' and $124.1 million is recorded exposure rather than confirmed criminal proceeds, since public records often do not show whether ransoms were paid, recovered, or frozen.

The composition of the attacks is the sharper finding. Home invasions rose from a single verified case in H1 2025 to 20 in H1 2026, roughly 41% of all incidents, making them the most common attack type for the first time. Kidnappings rose from 12 to 16. Simple robberies, the opportunistic street-level version of the crime, fell to 1.

Average recorded exposure per incident climbed from roughly $270,000 to $2.39 million, a 9x jump. Geographically the problem is concentrated: Europe accounted for 39 of the 52 cases, and France alone accounted for 33, or 63.5% of the worldwide total.

The threat model for self-custody now includes your front door. The answer is not giving up your keys: it is structuring them so that physical coercion cannot move them.

From Opportunism to Targeting

The vector shift is the story. A street robbery requires nothing but proximity and a victim careless enough to reveal a phone wallet. A home invasion requires the attacker to know who the target is, where they live, what they hold, and that the expected haul justifies the risk of a prepared entry into a private residence.

Twenty home invasions in 6 months, with average per-incident exposure up 9x, means crews are doing pre-attack intelligence work and selecting high-value targets deliberately. This is the pattern OPNorange documented in 'The $5 Wrench Is Now the #1 Threat to Your Bitcoin' in February and in the May coverage of Binance's anti-coercion withdrawal lock: organized groups conducting surveillance against pre-identified holders, not muggers getting lucky.

Where does the targeting data come from? The candidate sources are well known: leaked customer databases that link identity, home address, and crypto activity (the 2020 Ledger breach remains the canonical example, and every KYC database since is a candidate for the next one), public social media disclosure of holdings, conference attendance, and on-chain analysis tied back to identity through exchange records.

The per-incident exposure figure suggests the intelligence is good. Criminals who could not distinguish a $50,000 holder from a $5 million holder would show a flat exposure distribution. A 9x jump in average exposure per attack, concentrated in the vector that requires the most preparation, indicates they can tell the difference.

France Is the Epicenter, and the Definitions Matter

CertiK's 33 verified French incidents sit alongside a larger official number: French Interior Minister Laurent Nunez told the Association for the Development of Digital Assets (ADAN) on June 30 that France logged 77 crypto-linked cases of kidnapping, unlawful detention, extortion, or attempted extortion in the first half of 2026, up from roughly 45 in all of 2025.

The gap between 33 and 77 is definitional (the ministry counts attempts and extortion cases CertiK cannot independently verify), and it cuts in an uncomfortable direction: the verified number is probably the floor, not the ceiling. France's response is a three-pillar plan built with the industry: intelligence sharing on the criminal networks, a formal expert network connecting state security officials with exchanges and custodians, and operational coordination with the countries where organizers are based.

Nunez cited roughly 200 arrests and 724 holders enrolled in a state protection program.

The honest counter-reading of the report deserves space. France's concentration in the data partly reflects that France is now the jurisdiction that tracks and prosecutes these cases most aggressively, which inflates its apparent share; verified-incident counts rise when verification improves, not only when crime does; and recorded exposure includes demands that were never paid.

All of that is true, and the trend survives it. CertiK's count, Jameson Lopp's public tracker of physical attacks on holders, and the French ministry's own casework have moved in the same direction for 3 consecutive reporting periods, and the vector shift toward home invasion is visible in all of them.

A measurement problem this consistent is a measurement of something real.

What This Means for You

Physical operational security is now a core part of key management, not an exotic edge case. The threat this report describes does not operate against your wallet software; it operates against you. The first line of defense is privacy hygiene, because every documented targeting pathway starts with information: never disclose holdings publicly or socially, treat any service that links your legal identity, home address, and crypto activity as a future breach (that is what a KYC database is), and minimize the number of such linkages you create.

The state protection programs are worth watching but cannot be the plan: France's covers 724 enrolled holders in a country whose own ministry logged 77 cases in 6 months, and police protection stops at the border.

The second line is key architecture that makes fast compliance impossible. A BIP-39 passphrase (the optional 25th word) lets a hardware wallet hold a decoy wallet with a small balance alongside the real one, so there is something to surrender under duress. Multi-sig with keys in geographically separate locations means no single person in a single room, however coerced, can move the funds: an attacker in your home controls at most 1 key of 3.

Timelocks and vault constructions add a delay an intruder cannot wait out, converting a 30-minute home invasion into a multi-day commitment with rising detection risk. The common principle: do not rely on your willingness to resist, which is a variable no one should bet on. Rely on a structure in which resistance is not required because compliance is not possible.

None of this is an argument against holding your own keys. Custodial accounts concentrate a different set of risks (freeze authority, issuer control, jurisdictional seizure, and the exchange's own breach surface), and this series has documented all of them. The argument is narrower: self-custody removes the custodian from your threat model and leaves you in it.

Key control without physical opsec is a half-built defense, and the H1 2026 data shows the attackers have noticed which half is missing.

What to Watch

Watch whether the H2 2026 numbers confirm home invasion as the durable primary vector or show displacement as defenses adapt, and whether France's three-pillar plan measurably bends its curve (the 200-arrest figure will either grow into a deterrent or plateau into a statistic). Watch whether other high-incident jurisdictions copy the French protection-program model, and whether major exchanges follow Binance's withdrawal lock with counter-coercion features of their own, which would concentrate attacker attention on self-custody holders without duress protection.

And watch the CertiK and Jameson Lopp trackers themselves: at the current run rate, 2026 will set a record for verified physical attacks, and the per-incident exposure trend will show whether targeting intelligence keeps improving.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.