More than $30 million stolen in violent crypto attacks in 2026 as France emerges as 'wrench attack' hotspot: Chainalysis

Violent criminals have stolen more than $30 million in cryptocurrency from holders through the first half of 2026, putting the year on track to become the worst on record for physical attacks on crypto owners, Chainalysis said Thursday.

The figure counts only successful thefts and cases where a victim gave up funds. Figures provided by the blockchain analytics firm noted that this year trails 2025's full-year record of $58 million but notably arrives at mid-year.

Chainalysis warned the pattern would surpass that total if it holds through the second half.

Counting attempts as well as completed thefts — ransoms demanded, coerced transfers that were blocked, and funds later frozen or recovered — the totals run far higher, at roughly $316 million in 2024, $180 million in 2025, and $107 million so far in 2026, according to the firm.

Chainalysis called even those figures a likely undercount, since they capture only reported attacks.

The attacks, known in security circles as "wrench attacks," span home invasions, kidnappings, and hostage situations, and target crypto holders because they can be forced to transfer wealth in an instantly and irreversibly movable form.

France stands apart

No country illustrates the surge more than France, according to Chainalysis.

The firm said it had recorded only a handful of crypto-related violent incidents before 2025, when the number jumped to 19. Through mid-2026, Chainalysis has already logged 30 publicly known cases, and the true scale is most likely even larger.

French Interior Minister Laurent Nunez said in late June that authorities had documented more than 70 crypto-related violent incidents.

The attacks have also spread well beyond Paris, reaching other European cities like Strasbourg, Marseille, Grenoble, Toulouse, Nantes, and smaller communes that had never recorded such incidents, according to the firm.

The Block has reported several individual cases feeding into that trend. Armed intruders bound a mother, her two children and two grandparents for hours in northwest France in April, forcing a roughly $820,000 transfer.

A month earlier, attackers posing as police coerced about $1 million in bitcoin from a couple in a Paris suburb, and in February three suspects were arrested after a botched home invasion targeting the head of Binance France.

A data breach at the root

Chainalysis points to a data compromise as the likeliest driver behind the recent spate of attacks.

In 2024, a French tax official in the Paris area is alleged to have stolen and sold dossiers on high-net-worth crypto holders, including names, addresses, holdings, phone numbers, and tax records, with criminal intermediaries said to have bought them.

It’s also important to note that the attack pace accelerated after two January 2026 events, according to the firm.

French authorities made the tax case public, and the crypto tax-reporting firm Waltio disclosed a separate breach of some 50,000 users.

Attacks rose from about 1.9 a month in 2025 to roughly 4.6 in the first half of 2026. France's organized-crime prosecutors have since responded with about 200 arrests, 88 indictments, and 75 suspects held in pretrial detention by mid-year.

Attackers are turning to families

The nature of the attacks is shifting as bad actors deploy sinister tactics.

Chainalysis found that incidents targeting family members or acquaintances rather than the holder rose to about 25% to 30% of cases by early 2026, from near zero in 2021, a pattern even more pronounced in France, where relations were targeted in over 40% of cases.

Home invasions have climbed to 37% of 2026 incidents, up from 14% in 2025, while kidnappings account for 52%, Chainalysis said.

However, the firm noted that the labels carry a major caveat. Under the classification “other trackers,” where forced entry counts as a home invasion, roughly six of its 2026 kidnappings — most in France — would instead register as home invasions, making that the most common category.

The vast majority of victims are also notably local residents rather than tourists — 93% in France, 82% in Brazil, 77% in the United States — a pattern Chainalysis said points to reconnaissance and planning behind the attacks rather than opportunism.

The underlying events are the same, only the labeling differs.

On the flip side, attackers are still succeeding less often even as they strike more. Through late June, 26% of theft attempts resulted in a payment, down from 49% in 2025 and 67% in 2024.

Chainalysis attributes that decline to the more numerous and indiscriminate wave in France displacing the targeted, intelligence-driven attacks of earlier years.

The money leaves a trail

Once funds are taken, they usually quickly move onchain, and Chainalysis said the laundering reveals an obvious sophisticated spectrum.

Some attackers send stolen crypto straight to centralized exchanges with no attempt to hide it, while others route funds through decentralized exchanges, bridges and cross-chain tools to obfuscate the trail.

At the most advanced end sit actors embedded in broader criminal networks.

In one case, stolen funds flowed through an instant exchange into a suspected laundering service tied to cartel money-laundering networks, terrorist-financing clusters and wallets linked to an alleged cocaine trafficker, according to the firm.