A surge in crypto-related kidnappings has placed France under international scrutiny, prompting government officials to acknowledge the severity of the issue and announce new measures to tackle the problem. At least 41 such incidents have been reported this year, translating to roughly one every two to three days. Minister Delegate to the Interior Ministry, Jean-Didier Berger, has revealed plans to introduce a new set of measures in collaboration with Interior Minister Laurent Nuñez to address the growing concern. Despite the launch of a prevention platform that has garnered thousands of registrations, authorities concede that further action is necessary as the frequency of these incidents continues to rise.
The term 'wrench attack' refers to the use of physical force to gain access to digital assets, exploiting the fact that crypto transactions are irreversible. Unlike traditional bank transfers, once a victim is coerced into authorizing a transfer, the funds can be swiftly moved across wallets and chains. Researchers note a shift in the tactics employed by attackers, from targeting technical vulnerabilities to 'hunting' individuals by building profiles based on social media activity, public appearances, and leaked datasets. This approach allows them to identify points of weakness and track routines.
The biggest mistake crypto owners can make is linking their real-world identity, location, and routine too closely to their visible crypto wealth. The problem is exacerbated when attackers receive inside help from government officials, as seen in a case where a French tax official sold sensitive data to wrench attackers.
The pool of potential victims has expanded, with mid-level holders being increasingly targeted based on limited or indirect signals. Cases now involve families, with children being targeted alongside their crypto-holding parents, making the attacks harder to categorize by severity. In one notable incident, Ledger co-founder David Balland was kidnapped in France, and his finger was severed as part of a ransom demand.
Other cases have involved prolonged captivity, torture, and even waterboarding and sexual violence. Security experts observe that both opportunistic and organized groups are involved, with signs of increasing coordination. After obtaining funds, attackers tend to move quickly, converting the crypto assets into stablecoins and routing them across multiple chains to make recovery more difficult.
France's role in this trend may be attributed to a combination of factors, including cases involving leaked personal data and cross-border criminal networks. Rising asset prices have increased the potential payoff from a single attack, while improvements in digital security have reduced the effectiveness of purely technical exploits.
The increase in attacks has raised questions about the risks of self-custody, a core principle of cryptocurrency. Security experts recommend measures such as multi-signature setups, withdrawal delays, and spending limits to reduce risk by limiting how much can be accessed under duress. As crypto adoption grows, attacks are becoming more frequent and severe, transforming what was once a niche concern into a broader security risk.