Crypto Wrench Attacks Are Rising in Europe — Is this becoming a Bigger Trend?

• Crypto wrench attacks reach Spain as police arrest two suspects over a €20,000 robbery.
• CertiK records 52 global attacks in H1 2026, a 33.3% increase from the year before.
• France accounts for 33 of Europe’s 39 verified wrench attacks in the first half of 2026.

Spanish police have arrested two suspects over a Finestrat robbery involving crypto, cash, and gold. The victim reported being restrained and assaulted for hours to force digital asset transfers. The case adds to Europe’s record of crypto wrench attacks.

CertiK recorded 52 verified attacks worldwide during the first half of 2026, up from 39 a year earlier. That 33.3% increase supports a broader trend, although differences in reporting leave the full scale uncertain. 

Wrench attacks use violence or threats to obtain digital assets or wallet access. The term covers several crimes, including kidnapping, forced transfers, and home invasions. 

What Happened in Finestrat?

Spain’s Interior Ministry disclosed the case on September 18. The victim reported that attackers restrained his hands and feet inside his rented apartment. Police put the combined value of stolen cash, gold, and crypto at nearly €20,000.

That figure covers all the stolen property. Authorities did not disclose the crypto portion or identify the assets transferred. Investigators said a woman had gained the victim’s trust months before the attack. 

Officers arrested a 29-year-old man and a 23-year-old woman in Guipúzcoa and Barcelona. A court ordered the man held in pretrial detention, while the woman was released under precautionary measures. Both remain suspects, and the investigation continues. 

How Many Crypto Wrench Attacks Hit Europe?

The annual figures show a marked rise, though researchers publish different totals. CertiK verified 72 incidents worldwide in 2025, up 75% from 2024. A separate TRM Labs report cited open-source research recording about 70 attacks in 2025. 

Chainalysis counted 95 violent theft attempts in 2025 and 46 through late June 2026. Its figures include unsuccessful attempts, making a distinction between the number of attacks and those that resulted in payment. 

France’s prominence predates the Finestrat case. It led national rankings in CertiK’s 2025 report, when Europe accounted for more than 40% of verified attacks. 

Within CertiK’s first-half data, European incidents rose from 14 in 2025 to 39 in 2026. France accounted for 33 of those 39 cases, so the regional increase is heavily concentrated in one country. 

Home Invasions and Kidnappings Widen the Threat

CertiK recorded 20 home invasions in the first half of 2026, compared with one a year earlier. Kidnappings rose from 12 to 16 over the same periods.

Ledger co-founder David Balland and his partner were abducted in France in January 2025. The kidnappers demanded crypto from another company co-founder. Police rescued both victims, who had been held at separate locations. 

Family members remain exposed. In April 2026, attackers entered a home in France’s Yonne department and demanded $400,000 in crypto. They abducted a mother and her 11-year-old son after learning that transferring the funds required several days.

Police freed both hostages the next morning and arrested seven suspects. Officers found the mother and child in a hotel in Boissy-Saint-Léger after the father escaped his restraints and raised the alarm. 

CertiK also documented a March 2026 attack in the United Kingdom involving crypto holder Sillytuna. Its report put the assets taken under physical coercion at about $24 million.

Why Has France Become a Hotspot?

Chainalysis says holders attract criminals because digital wealth is often accessible through a phone or wallet device. Transfers also lack the institutional checks associated with withdrawing money through a bank.

The firm identifies exposed personal and financial data as a likely driver of France’s surge. Its report links the targeting risk to alleged misuse of tax records and a separate breach at crypto tax service Waltio. That assessment does not establish the source of information used in every attack.

Waltio said it discovered its breach on January 21, 2026. Exposed data included email addresses, 2024 gains or losses, and year-end crypto balances. The company said postal addresses, private keys and information enabling wallet access were not compromised. 

Who Is Being Targeted?

French authorities warned in January that the target group was expanding. Entrepreneurs and industry professionals remained exposed, while recent incidents also involved private holders. A public role in a crypto company is therefore only one route to visibility.

TRM’s report, co-authored with London’s Metropolitan Police, found public exposure in 47% of identified cases. Examples included posts about holdings, trading activity and visible links to crypto businesses. The police review covered 17 reported London offenses between March and December 2024.

Does the Increase Reflect Better Reporting?

Official records expose gaps in public datasets. A French gendarmerie article, updated September 11, lists 77 crypto-related kidnappings and unlawful detentions in 2026. That official tally is separate from researchers’ independently verified public cases.

TRM notes that police systems often classify these incidents as robbery or kidnapping without recording the crypto motive. Fear of repeat attacks also discourages victims from reporting. 

CertiK also identifies stronger public coverage as a factor in Europe’s recorded concentration. Its global second-quarter total remained at 17, matching 2025. The reports do not quantify how much improved detection, rather than additional violence, explains the increase.

Related: Kalshi Defends $5,500 Ether Perp Trades as Wash Trading Claims Mount