Physical coercion attacks targeting cryptocurrency holders reached $124 million in the first half of 2026, setting a record pace that threatens to nearly double full-year 2025 losses. According to CertiK's Intel3D Wrench Attacks Report released on July 23, 2026, thieves are increasingly bypassing sophisticated on-chain security by using a much simpler tool: physical force. The data reveals a troubling shift in who attackers target and where these crimes occur, challenging the assumption that self-custody and hardware wallets alone protect crypto assets.

What Exactly Is a Wrench Attack in Crypto?

The term "wrench attack" originated as a darkly practical joke in cryptography circles, based on a concept formulated decades ago by cryptographer Bruce Schneier: if an attacker can apply enough physical pressure, no amount of cryptographic protection matters. In crypto, the joke became a documented threat category.

CertiK's Intel3D unit tracks physical coercion incidents that result in the transfer of cryptocurrency under duress. This includes home invasions, street robberies, kidnappings, and forced device unlocking at gunpoint. The methodology covers publicly reported incidents cross-referenced against blockchain forensics where wallet addresses are known, plus law enforcement disclosures across 38 jurisdictions. Importantly, the $124 million figure does not include fraud, phishing, or on-chain exploits; it measures only incidents where physical force or the credible threat of force was used to compel a victim to transfer assets.

Why Are Physical Attacks Accelerating Now?

Physical crypto attacks were negligible before 2020. The first systematic tracking, conducted by researcher Jameson Lopp, catalogued fewer than 20 documented attacks per year between 2015 and 2018. The inflection point came in 2021 when Bitcoin (BTC) surpassed $60,000 for the first time, mainstream media ran thousands of stories about crypto millionaires, and the addressable pool of potential victims became meaningfully large. By 2025, documented incidents surpassed 100 confirmed cases globally. At the H1 2026 run rate, annual physical attack losses would reach approximately $248 million, nearly double the estimated full-year 2025 total.

The acceleration reflects rational criminal economics. Ultra-high-net-worth targets, exchange founders, and major fund managers now typically employ dedicated physical security and operate under assumed names for blockchain activity. Attacking them carries high operational risk. Mid-tier holders, by contrast, often self-custody significant assets, live ordinary residential lives, and have taken few or no physical security precautions. The risk-reward calculation for attackers has tilted decisively toward this demographic.

Where Are These Attacks Happening?

The early narrative around physical crypto attacks centered on Latin America and Southeast Asia, regions with high crypto adoption, weaker law enforcement capacity, and existing organized crime infrastructure. That geographic framing is now outdated. CertiK's H1 2026 data shows the United States and Western Europe collectively accounting for 38 percent of documented incidents by case count, up from approximately 22 percent in 2023. This represents the fastest-growing geographic segment in CertiK's dataset.

This geographic shift has a structural explanation. Regulatory normalization, spot Bitcoin ETF (exchange-traded fund) approvals in the US, and MiCA (Markets in Crypto-Assets) compliance frameworks in Europe have brought crypto wealth into more public view. Institutional holders file public disclosures. Founders and executives appear on conference panels discussing their portfolios. Tax reporting requirements in multiple jurisdictions have created paper trails that sophisticated criminal networks have allegedly accessed to identify targets.

• United States: Accounted for the largest single-country share at 19 percent of global documented incidents
• United Kingdom, Netherlands, and Germany: All recorded high-profile cases in 2026
• Southeast Asia: Remains a high-volume region, particularly Thailand, Vietnam, and Indonesia, where several high-profile kidnapping cases made international news in Q1 2026
• Latin America: Brazil, Argentina, and Colombia continue to generate a disproportionate share of street-level robbery incidents involving mobile wallet theft

Who Are the Targets Now?

The popular image of the wrench attack victim is a publicly known crypto billionaire. That image is increasingly wrong. CertiK's incident profiling for H1 2026 reveals a significant shift toward mid-tier holders, individuals with between $100,000 and $5 million in documented or inferable crypto holdings. Social media exposure is a documented precursor in a substantial subset of cases, meaning that retail crypto enthusiasts who publicly discuss their holdings or share details about their investments online face elevated risk.

This shift reflects a troubling reality: the industry's obsession with on-chain security has created a blind spot. Self-custody without operational security training is now a measurable liability. Hardware wallet adoption, without accompanying physical security practices, may actually be increasing risk rather than reducing it for the average retail holder, because it signals to potential attackers that valuable assets are stored locally rather than on an exchange.

How to Reduce Your Physical Security Risk

• Maintain Operational Security Discipline: Avoid publicly discussing your crypto holdings on social media, at conferences, or in professional settings where your identity can be linked to your assets
• Separate Your On-Chain Identity: Use different wallet addresses and assumed names for blockchain activity to prevent criminals from building a profile of your holdings and location
• Implement Physical Security Measures: If you self-custody significant assets, treat physical security with the same rigor as on-chain security, including home security systems, secure storage locations, and awareness of your surroundings
• Diversify Storage Methods: Consider splitting holdings across multiple storage locations and methods rather than keeping all assets in a single hardware wallet that could be targeted in a single incident
• Educate Yourself on Threat Modeling: Understand that the threat landscape has shifted from purely technical attacks to physical coercion, and adjust your security posture accordingly

What Does the Data Actually Represent?

A critical methodological point: the $124 million total for H1 2026 reflects confirmed or forensically corroborated incidents, meaning the actual figure, accounting for unreported cases, is almost certainly higher. Law enforcement reporting rates for crypto-related robbery remain lower than for conventional robbery in most jurisdictions, partly because victims fear regulatory scrutiny of their holdings and partly because recovery prospects are perceived as poor. CertiK's analysts estimate that documented cases represent 60 to 70 percent of actual incidents based on dark web forum chatter and insurance claim patterns. The true H1 2026 toll may approach $180 to $200 million.

"The $124 million total for H1 2026 is not a projection, it reflects confirmed or forensically corroborated incidents, meaning the actual figure, accounting for unreported cases, is almost certainly higher," according to CertiK's analysis.

CertiK Intel3D Unit, Wrench Attacks Report H1 2026

The convergence of geographic distribution means this is no longer a problem that wealthy-world crypto holders can dismiss as something that happens elsewhere. As regulatory frameworks normalize crypto ownership and more individuals hold meaningful amounts of self-custodied assets, the addressable target pool continues to expand. The industry's focus on preventing on-chain theft through audits, multi-signature wallets, hardware signing devices, and zero-knowledge proofs has created a false sense of security. These tools are sophisticated and effective at preventing technical exploits, but they offer zero protection against an attacker with a wrench and the willingness to use it.