CertiK report: In the first half of 2026, the number of crypto “hand tool” attack incidents increased by 33%, financial exposure surged by 12 times, and home invasions overwhelmingly replaced kidnappings.

Blockchain security auditing firm CertiK released the “Intel3D Wrench Attack Report for the First Half of 2026.” There were 52 verified cases globally, up 33.3% year over year. Home robberies surged from just 1 case last year to 20 cases, replacing kidnapping as the primary form of attack. Total financial exposure reached $124 million, up 11.8-fold year over year. Europe accounted for 39 cases (75%). France ranked first globally with 33 cases, and the French Minister of the Interior confirmed 77 crypto-related extortion and blackmail cases recorded in the first half.
（Background: CertiK released the Skynet report: In 2025, “wrench attacks” surged by 75%, and physical violence became an important threat in the crypto sector）
（Additional context: Immunefi: In the first half of 2026, the number of crypto hacker attacks hit a new high, with total losses of less than $1 billion）

Table of contents

Toggle

• Key data overview: One chart to understand the wrench attack trends in the first half of 2026
• Home robbery replaces kidnapping, becoming the first form of attack
• France and Europe: Geographic concentration of crypto violent attacks
• Explosive growth in financial exposure: from $10.5 million to $124 million
• Evolution of criminal methods: from digital intrusion to physical coercion
• Asia perspective: lessons from Singapore and potential risks for Taiwan
• Rethinking self-custody: a layered defense architecture

Key data overview: One chart to understand the wrench attack trends in the first half of 2026

CertiK, a blockchain security audit company, said in its Intel3D report released on July 23 that wrench attacks against global crypto in the first half of 2026 are showing a grim trend of rising both volume and value. The following are the core metrics side by side:

• Total number of attacks: 52 (H1 2025: 39), up 33.3% year over year
• Home robberies: 20 (only 1 in the same period last year), up 20x, replacing kidnapping as the most common form
• Kidnapping cases: 16 (12 in the same period last year), up 33% year over year
• Robbery cases: 1 (5 in the same period last year), a significant decline
• Financial exposure: about $124 million (vs. $10.5 million in the same period last year), up 11.8x year over year
• Geographic concentration: 39 cases in Europe (75% of the global total); France alone had 33 cases (63% of the global total)

CertiK noted that total financial exposure not only includes confirmed stolen assets, but also covers ransom demands, assets forcibly transferred by victims, assets that were frozen and later recovered, and unsuccessful ransom demands. Actual net losses may be lower than this figure, but the rapid expansion of exposure size itself reflects a significant increase in criminals’ expected returns from the crypto sector.

Home robberies replace kidnapping, becoming the top form of attack

The report’s most notable finding is a structural shift in the composition of attack methods. Home robberies jumped from a marginal incident in the first half of 2025 (1 case) to the most common method (20 cases), accounting for nearly two-fifths of all cases. At the same time, traditional kidnapping methods also rose from 12 cases to 16, but their share fell from 31% to 31%—diluted by the explosive growth of home robberies.

CertiK’s analysis suggests this shift reflects tactical optimization by criminal groups. The execution threshold for home robberies is lower than for kidnapping (no need for long-term surveillance, kidnapping locations, or hostage management), yet it can still achieve the core goal of “bypassing digital defenses through physical coercion.” Criminals launch attacks at victims’ homes—considered the safest location—forcing holders and their family members to hand over private keys or login credentials.

Notably, the number of traditional street robbery cases fell from 5 to 1, possibly reflecting criminals realizing that “taking a hardware wallet or phone outside” cannot guarantee access to funds. If the device has password protection or uses multi-signature configurations, the success rate of street robberies is far lower than coercing victims into carrying out transfers themselves at home.

France and Europe: Geographic concentration of crypto violent attacks

From a regional distribution perspective, crypto wrench attacks are highly concentrated in Western Europe. The European continent recorded a total of 39 cases, accounting for 75% of the 52 global cases. France, as a single country, reported 33 cases, accounting for 63% of the global total and 85% of Europe’s total.

On July 2, French Interior Minister Laurent Nuñez confirmed that authorities recorded 77 cases involving kidnapping, extortion, or attempted extortion related to cryptocurrencies in the first half of 2026—far higher than the 45 cases in all of 2025. Nuñez said emergency response measures led to the arrest of about 200 people. CertiK specifically noted that its statistical methodology is stricter than France’s official approach: it only counts publicly reported cases that can be independently verified. Therefore, 33 cases are the numbers after its strict filtering (France’s 77 cases also include cases that were not independently verified).

CertiK speculated that France’s high concentration may be related to the country’s relatively transparent crypto ecosystem—data leaks link identities and addresses to recognized crypto wealth, making holders easier to target. In addition, while France’s regulatory framework for crypto assets (such as the PSAN registration system) attracts legitimate businesses, it also enables criminal groups to identify potential targets from public information.

Explosive growth in financial exposure: from $10.5 million to $124 million

A financial exposure growth of 11.8x year over year—from $10.5 million to $124 million—is another signal that needs to be taken seriously. Although exposure does not equal actual losses (some assets may be frozen or recovered), its growth rate far outpaces the increase in the number of cases (33.3%). This implies:

• A major rise in average exposure per case: from about $270k to about $2.4 million, nearly a 9x increase
• Escalation of criminal targets: criminals shifted from randomly targeting small holders to targeting high-net-worth targets and mid-sized institutions
• Ransom amounts rising accordingly: as major crypto asset prices such as Bitcoin have remained steady at high levels, criminals’ estimated valuations of victims’ finances also increase

Compared with traditional digital hacker attacks—Immunefi’s parallel report shows total crypto hacker losses in the first half of 2026 were less than $1 billion—the financial exposure of wrench attacks may have a smaller absolute value, but the steepness of its growth curve far exceeds that of DeFi exploits and smart contract attacks. This indicates that “physical intrusion” is rapidly becoming an important complementary channel for crypto crime.

Evolution of criminal methods: from digital intrusion to physical coercion

The deep trend revealed by the CertiK report is that as digital protection technologies (multi-signature, cold wallets, hardware security modules) become increasingly mature, criminals start turning to the weakest link in the attack chain—humans themselves. The surge in home robberies does not mean traditional digital hacking has decreased (in fact, Immunefi’s report says the number of hacking attacks is at an all-time high). Instead, criminal groups are adopting a “dual-track strategy”:

• Digital track: attacking technical vulnerabilities in DeFi protocols, cross-chain bridges, and centralized exchanges
• Physical track: targeting holders personally through home robberies, kidnappings, and extortion—using violence to bypass all technical defenses

This dual-track approach means that simply strengthening cold wallet security or not carrying large amounts of assets is no longer enough to block physical-layer threats. When victims are forced at gunpoint in their homes, even if private keys are hidden in a bank vault safe, they may still be compelled to call the bank and request the safe be opened.

Asia perspective: lessons from Singapore and potential risks for Taiwan

Although CertiK’s statistics are highly concentrated in Europe and France, Asia is not immune. The report specifically uses Singapore as an example, warning that self-custody holders face a new type of physical threat. CertiK said the high concentration of crypto wealth in Asia (Singapore, Hong Kong, and Dubai as the three main hubs), combined with high private security costs in some regions, is gradually making high-net-worth holders potential targets.

For Taiwan, although it has not yet been listed by CertiK as a statistical hotspot, the following risk factors deserve attention:

• Exchange KYC data leaks: CertiK specifically pointed out in the report that data breach incidents are a main channel through which criminals lock onto targets. Taiwan has one of the highest densities of crypto exchanges globally, and the risk of leakage of user identities and asset information cannot be ignored
• Overexposure on social media: CertiK’s tracking found that criminals often use social platforms (X, Telegram, Discord) to identify users who show off their crypto assets. Taiwan’s preference for a “trading/show-off” culture may increase the risk of being targeted
• Linkage between real estate and crypto assets: as with France’s transparent ecosystem, if Taiwan’s land registry data and tax information are cross-referenced with exchange reporting, individuals holding large amounts of crypto assets may be indirectly identified

Rethinking self-custody: a layered defense architecture

In response to the rise of physical coercion attacks, CertiK advises holders to rethink how they practice self-custody—not just as a problem of cryptography and private key management, but as a systematic engineering effort involving personal safety and operational processes.

• Multi-signature and multi-party computation (MPC): use multisig or MPC configurations so that a single coerced signer cannot immediately release all assets
• Withdrawal delays and spending limits: set transaction time-locks and daily withdrawal caps so that even if forced to operate, funds cannot instantly be moved out completely, giving time to pursue recovery
• Geographically distributed signers: distribute multisig signers across different countries or cities so attackers cannot coerce all signers in the same location
• A “panic password” mechanism: set a special password or operation sequence that, once triggered, immediately notifies co-signers, freezes assets, or activates a predefined funds transfer plan
• Strengthening physical security: for high-net-worth holders, home security systems (surveillance, alarm connections, anti-theft doors) and a low-key lifestyle may be more effective defenses than any cryptographic方案

In its conclusion, CertiK emphasized that as the market value of crypto assets continues to grow and mainstream adoption increases, the financial incentives for wrench attacks will only rise, not decline. Evolving from “protecting private keys” to “protecting the people who hold private keys” will be the core challenge the crypto security industry must face in the coming years. This is not only a technical issue—it also involves legal frameworks (criminal recognition in different countries for forced transfer of digital assets), insurance products (insurance against violent theft of crypto assets), and community education (how to participate in the market without exposing one’s asset situation).