'Wrench' attacks against crypto holders appear to be on the rise

Crypto theft is increasingly shifting from online attacks to physical coercion, known as ‘wrench’ attacks. CertiK reports a 33% year-over-year increase in these in-person attacks, with a significant rise in associated financial losses – $124 million reported so far in 2026. These attacks leverage the vulnerability of self-custody wallets, where victims are solely responsible for securing their assets.

“Wrench” attacks – the crypto industry’s term for in-person, strong-arm tactics – are becoming more prevalent. CertiK’s analysis indicates a substantial increase in these incidents, driven by the fact that attackers don’t need direct access to the primary holder if they can threaten a spouse, parent, child, employee, driver, assistant, or close friend. Proxy victims often have weaker operational security, more predictable routines, and less training than the primary target.

Examples include the kidnapping of a French mother and child in April, a 2025 home invasion in Minnesota, and a 2024 case in Connecticut involving a carjacked Lamborghini. Security firms and law enforcement have been sounding the alarm about wrench attacks over the last couple of years, with TRM Labs reporting on the phenomenon last March and CryptoUK hosting a webinar with law enforcement in December.

The rise in reported losses – $124 million – is likely an underestimation of the true financial scale of these attacks, as it includes not only funds coerced from victims but also assets that may have been frozen. The trend highlights a critical security gap for crypto holders who maintain full control over their private keys.