The firm verified 52 "wrench attacks"—incidents in which criminals use violence or threats to force victims to hand over crypto—in the first half of 2026, up by a third from 39 a year earlier. Recorded financial exposure climbed almost 12-fold to $124.1 million, from $10.5 million in H1 2025, lifting the average recorded haul per incident from $270,000 to $2.39 million.
The CertiK Intel3D H1 2026 Wrench Attacks Report is here.
Crypto crime has gone physical.
Our latest research found:• 52 verified wrench attacks (+33.3% YoY)• $124.2M in recorded exposure• Home invasions emerged as the dominant attack vector
CertiK cautioned that the figures capture ransom demands and frozen or recovered assets, not just confirmed stolen value, and that under-reporting remains severe as victims fear retaliation or reputational damage.
The “defining shift,” the report says, is a surge in home invasions. From a single publicly reported case in H1 2025, break-ins have risen to 20 in the first half of 2026, about 41% of all incidents, as attackers began targeting the entire security perimeter of a victim: their residence, family, and ability to stay calm under duress. Kidnapping stayed high, rising from 12 to 16 cases, while one murder was recorded in each period.
Crypto wrench attacks around the worldCertiK also described an increasingly professional, layered model, with organizers who buy data and coordinate logistics sitting above disposable, often young operators recruited on messaging apps. Crews now assemble "target packages" from leaked databases, exchange records, and on-chain activity, making data minimization, the firm argues, a physical-safety measure.
