Crypto ‘Wrench Attacks’ Hit $124M in H1, CertiK Says

CertiK Records 52 Crypto Wrench Attacks in H1

CertiK said the first-quarter acceleration drove the full-half result. It recorded 35 cases in the first three months of 2026, compared with 22 in the same period of 2025, then recorded 17 cases in the second quarter, matching the prior-year quarter.

The figures are intended as a documented baseline, not a forecast. CertiK said a straight-line annualization would suggest about 100 incidents for 2026, but it cautioned that the first half had two distinct periods and that reporting delays can change later counts.

Recorded exposure rose to $124,180,400 from $10,532,242, CertiK said. That lifted average recorded exposure per case to about $2.39 million from roughly $270,000. It is a material distinction from a conventional hack-loss table: a ransom demand, a payment, an amount frozen by authorities and a stolen asset can all be part of the total, without each being the same thing.

The firm’s separate Hack3D report put total Web3 losses at about $1.32 billion across 344 incidents in H1. Wrench attacks therefore remain a smaller part of the broader loss count, but their mechanism is different: attackers aim at the person who can authorize a valid transaction instead of breaking a protocol’s code.

Daily Crypto Briefs covered that distinction after two Texas brothers pleaded guilty in an $8 million crypto kidnapping case. A blockchain transfer may leave an investigative trail, but the transaction can still be technically valid when a victim is forced to sign it.

France Accounts for 33 of the Verified Cases

France represented 63.5% of CertiK’s global dataset and 84.6% of the Europe total. The report counted 33 verified French cases in H1, compared with 10 a year earlier; it separately noted that French police data may show more incidents because official reporting and CertiK’s narrower public-verification method do not measure exactly the same set of events.

Home invasions were the report’s clearest tactical change. CertiK recorded 20 in H1 2026, up from one a year before. Kidnappings rose to 16 from 12, while the firm recorded four torture cases and one murder in each half-year. Those classifications describe the dominant form of coercion reported in each case, rather than the full legal disposition of every investigation.

CertiK did not attribute the French concentration to one factor. It cited the country’s visible crypto ecosystem, the availability of administrative and identity data, and more extensive public reporting as possible reasons that cases appear more often in the verifiable record. The report says those conditions can be combined with social-media profiles, public wallet activity and other information to identify targets.

The same data-risk premise has appeared in other parts of the industry. Daily Crypto Briefs’ coverage of the Ledger-linked Global-e data breach noted that contact details can make phishing more convincing; in a physical-threat setting, exposed names, addresses and routines can be more consequential still.

Home Invasions Put Custody Controls Under Scrutiny

The report’s core operational point is that a single-signature wallet can be fragile under duress. Cold storage protects against many online attacks, but a device and recovery material held in one residence may be accessible if a holder is compelled to unlock or search for them.

CertiK recommends reducing unnecessary disclosure of wallet details, travel routines and home information; separating routine spending wallets from long-term reserves; and using time delays, allowlists, transaction thresholds or multi-party signing where appropriate. Those are risk-reduction measures, not guarantees, and users should weigh them against their own legal, custody and recovery requirements.

The report also describes proxy targeting, in which an attacker pressures a family member, employee or associate rather than the main holder. That makes the security question broader than the private key alone, particularly for founders who retain unilateral control over treasury wallets, administrative permissions or emergency access.

For self-custody users, the distinction is useful when considering product claims. Daily Crypto Briefs’ look at a physical attack on older wallet hardware concerned a different vector, but both cases show why a device is a control layer rather than a complete security plan.

The Crypto Fear and Greed Index read 28, classified as Fear, on July 24. The market-wide measure does not track physical crime, but it provides context as Bitcoin remained below its July 22 high.

The next evidence to watch is whether later law-enforcement disclosures or CertiK updates change the verified total, and whether companies with high-value signers adopt controls that leave no one person able to move significant funds immediately. CertiK’s report establishes a documented increase in reported physical coercion; it does not establish that every holder faces the same level of risk or that the H1 pace will continue.