Crypto thieves are increasingly looking to steal virtual currency from victims in physical attacks, with tens of millions lost so far this year, according to a new Chainalysis report.
The blockchain analytics firm revealed new information from its forthcoming mid-year crypto crime report on August 6.
It claimed that so-called “wrench attacks” such as home invasions, kidnappings, and hostage situations, have escalated in recent years, with an estimated $30m lost in the first half of 2026. When “attempted extractions” are included, such as ransoms and stolen funds that are blocked, the figure rises to $107m.
“Criminals have recognized that crypto holders are high-value targets because they possess wealth in an instantly and irreversibly transferrable form,” the report said.
Read more on crypto theft: Coldcard Users Lose $89m After Bitcoin Wallet Is Hacked
Kidnappings (53%) have remained pretty stable as a share of total funds lost to wrench attacks, but home invasions now account for 37% of incidents, up from 26% in 2023.
“Home invasions allow criminals to confront victims in a controlled environment where they can compel a transfer of funds,” the report noted. “Kidnappings, by contrast, are much more difficult to execute. Attackers must expend considerable time and resources planning logistics; and the extended periods spent with victims leaves the attacker exposed for longer.”
France is by far the worst affected country. Chainalysis claimed this could be down to a 2024 data breach in which a local tax official stole and sold information on high-net-worth crypto holders, including their names, addresses, holdings, phone numbers, and tax records.
Attackers are increasingly targeting family members in order to force payment from crypto holders, with France once again the worst hit. There, over 40% of incidents in the first half of the year targeted a relation, the report continued.
Three Types of Crypto Theft
Analysis of crypto flows post theft reveals three levels of attacker sophistication, according to the report.
- Unsophisticated attacks are likely to be opportunistic, and involve the direct transfer of virtual funds to centralized exchanges, without any attempt to obfuscate. These are the easiest for law enforcement to trace, Chainalysis said
- Sophisticated attacks are carried out by crypto-aware thieves and use “decentralized exchanges, bridges, MEV bots, and other DeFi tools to swap and move assets across chains.” They avoid centralized exchanges as much as possible as the actors know that these entities enforce strict know your customer checks
- Criminally embedded attacks are similarly sophisticated but appear to be linked to broader organized crime networks. In one case, funds ended up in an over-the-counter (OTC) laundering service associated with cartels and terrorist financing, Chainalysis noted
