A wrench attack is the use of violence, or the threat of it, to force someone to hand over cryptocurrency or authorise a transfer. The name comes from the observation that no encryption survives an attacker willing to threaten the key holder with a cheap wrench. In practice wrench attacks take the form of home invasions, kidnappings and hostage-taking, and increasingly they target relatives of the person believed to control the funds.
For crypto organisations the question is not only personal safety, though that comes first. It is also whether the company's custody design means that coercing a founder, executive or signer can actually move company or client assets. If it can, the organisation has made its people more valuable targets. This guide covers both sides.
What a Wrench Attack Is
Chainalysis defines a wrench attack as a physical attack in which someone uses violence, or the threat of violence, to force a cryptocurrency holder to hand over assets, for instance by coercing them to unlock a wallet or transfer funds under duress. TRM Labs uses a similar definition and notes that these offences share high levels of violence that are extremely traumatic for victims. Our existing guide to physical security for crypto organisations covers offices, devices and key ceremony rooms. This article focuses on the people who hold or can authorise access to funds.
What the 2025 and 2026 Data Shows
Chainalysis published its analysis of violent crypto attacks on 6 August 2026. Its main findings, all of which it notes are likely to be undercounts because they reflect reported incidents only, are:
- Value successfully stolen in violent attacks reached a record $58 million in 2025, and more than $30 million had been stolen in 2026 by mid-year.
- Including attempted extractions, such as ransoms demanded and transfers that were coerced but blocked or later recovered, the totals were roughly $316 million in 2024, $180 million in 2025 and $107 million in 2026 so far.
- Attacker success rates fell from 67% (32 of 48) in 2024 to 49% (47 of 95) in 2025 and 26% (12 of 46) through late June 2026.
- Kidnappings made up 52% of 2026 incidents and home invasions 37%, up from 26% in 2023. Chainalysis notes that other trackers, which classify by the initial method of entry, would count more of these as home invasions.
- Incidents targeting family members or acquaintances rather than the holder accounted for roughly 25 to 30% of cases by early 2026, and over 40% in France.
- France recorded 19 publicly known incidents in 2025 and 30 by mid-2026. Chainalysis links the surge to an alleged theft and sale of French tax records on high-net-worth crypto holders, and to a separate breach of around 50,000 users at a crypto tax-reporting firm disclosed in January 2026.
TRM Labs' May 2025 review documents cases in France, the United States, the United Kingdom and Canada, including the January 2025 kidnapping of Ledger co-founder David Balland and his partner, and a US case in which, according to the charges TRM describes, a co-conspirator is accused of monitoring a victim's location remotely through their iCloud account while another broke into the home to steal a hardware wallet. Jameson Lopp maintains a public, sourced list of known physical attacks on crypto holders that shows the problem stretching back many years.
How Targets Are Chosen
The data points in one direction: these attacks are planned around information. Chainalysis reports that the large majority of victims were local residents rather than visitors, which it interprets as evidence of reconnaissance, and that most incidents it assessed were premeditated, with victims selected through exposed information from data breaches, social media or insider knowledge. TRM Labs similarly describes criminals profiling victims through social media for indicators of wealth.
For people in crypto organisations, the information that makes them targetable usually comes from a few places:
- Public role signals. Team pages, conference biographies and press coverage that describe someone as a founder, treasury lead or key holder.
- Leaked personal data. Customer databases at exchanges, tax tools and other services that combine identity, address and holdings. The French cases show how a single leak can create a target list.
- Linkable on-chain activity. ENS names, public donation addresses or social posts that tie a known person to a wallet with a visible balance.
- Lifestyle and location posting. Real-time travel, home details and family photographs.
- Insiders. Staff or contractors with access to HR, KYC or travel data. Our guide to employee security vetting covers this risk.
Custody Design: Make Coercion Pointless
The single most important organisational control is ensuring that no individual, under any pressure, can move material company or client funds alone, and that this is true in practice rather than on paper. TRM Labs recommends multi-signature arrangements for exactly this reason. Several design choices reinforce it:
- Quorum with genuine independence. A multisig or MPC quorum only resists coercion if the signers needed to reach it are not in the same place, household or travel party. Our guide to crypto multisig security covers signer distribution.
- Time delays on large transfers. A mandatory delay between proposal and execution for transfers above a threshold, with alerting to independent reviewers during the delay, means a coerced approval cannot complete during the attack.
- Velocity and destination limits. Daily limits and allowlisted destinations cap what any single session can move, and transfers to new addresses trigger additional review.
- No personal custody of company funds. Company assets should never sit in wallets that a founder controls alone on a personal device, however temporary the arrangement.
- Cold storage separated from people. Backups and recovery material for cold storage should be held in secured locations with multi-person access, not in a key holder's home. See our cold storage policy guide.
These controls only deter attackers if they are known to exist in general terms. It is reasonable to state publicly that the organisation uses multi-party approval and time delays, without disclosing who the signers are or how the quorum is configured.
Some individuals consider decoy or "duress" wallets holding smaller balances. This is a personal decision with real risks: an attacker who believes they have been deceived may escalate. Organisational controls that genuinely prevent a single person from moving funds are a sounder basis for policy than deception.
Reducing Personal Exposure
- Separate role from identity. Do not identify signers or treasury operators publicly. Describe functions, not names, in documentation that leaves the organisation.
- Minimise public personal data. Review what public registers, team pages and conference listings disclose about home locations, and use the privacy options available in your jurisdiction, such as service addresses where company registries allow them.
- Break wallet to identity links. Avoid naming personal or company treasury wallets with ENS names tied to individuals, and avoid publicly discussing personal holdings.
- Limit data held by third parties. Each service that stores your identity, address and holdings is a potential leak. Reduce the number of them and use separate contact details where possible.
- Delay location posts. Share travel and event attendance after the fact, not in real time.
Family, Home and Travel
Because a growing share of attacks targets relatives, protection has to extend beyond the employee. TRM Labs specifically recommends educating family members about the risks and warning signs. Practical measures include:
- A short, non-alarming briefing for family members about not discussing the employee's role or holdings, and about recognising surveillance or unusual approaches.
- A professional residential security assessment for people whose role is publicly known, covering access control, alarms and response arrangements proportionate to the risk.
- Travel arrangements for conferences that avoid publishing hotel details, use reputable transport, and do not combine signers whose presence together would reach a quorum. Our physical security guide for signing infrastructure covers related controls.
- An agreed, simple way for an employee or relative to signal distress to a trusted contact, and a clear understanding that the organisation will treat such a signal seriously.
During and After an Incident
Personal safety takes priority over funds. TRM Labs advises people who believe they are being targeted not to confront the threat directly, and to report it. Custody design should mean that complying with demands cannot move material company assets, which removes any pressure on the individual to resist.
- Contact the police as soon as it is safe to do so, and follow their direction on any ransom demand.
- Freeze organisational access. Suspend the affected person's credentials and signing participation, and raise approval thresholds until the situation is resolved.
- Trace funds immediately. Chainalysis's analysis shows that many attackers move funds to centralised exchanges, where compliance teams can freeze them, while more sophisticated actors route through bridges and laundering services. Early alerts to exchanges and analytics providers improve the chance of recovery.
- Support the people involved. These are traumatic events. Provide access to specialist support and do not rush people back into signing roles.
- Review exposure. Establish how the target was identified and close that route for everyone else.
Organisations should also check whether their insurance includes kidnap, ransom and extortion cover, and what conditions apply.
Building It Into the Security Programme
Wrench attack risk is often treated as a personal matter for founders, which leaves it outside governance. It belongs in the risk register alongside key compromise and insider threat, with an owner, a review cycle and a test. A useful exercise is a tabletop that asks: if a named signer were coerced tonight, what could the attacker move, how quickly would anyone know, and who would act? If the honest answer is "a lot, not quickly, and nobody in particular", the custody design needs work before anything else.
Frequently Asked Questions
What is a crypto wrench attack?
A crypto wrench attack is a physical attack in which violence or the threat of violence is used to force someone to hand over cryptocurrency or authorise a transfer. They include home invasions, kidnappings and hostage situations, and increasingly target relatives of the person believed to control the funds.
How common are crypto wrench attacks?
Chainalysis reported in August 2026 that value stolen in violent crypto attacks reached a record $58 million in 2025 and exceeded $30 million in the first half of 2026, with 46 incidents documented through late June 2026. It notes these figures are likely undercounts.
How do attackers choose wrench attack targets?
Chainalysis and TRM Labs both describe premeditated targeting based on exposed information, including data breaches, social media posts about wealth, public roles and insider knowledge. Most victims in Chainalysis's data were local residents, suggesting reconnaissance.
How can a crypto company protect its signers from coercion?
Design custody so that no single person can move material funds: use multi-party approval with independent signers, time delays and velocity limits on large transfers, allowlisted destinations, and keep signer identities private. Extend protection to families and travel arrangements.
Should crypto holders use duress wallets?
Decoy wallets are a personal decision with real risks, because an attacker who believes they have been deceived may escalate. For organisations, controls that genuinely prevent any one person from moving funds are a more reliable defence than deception.