The Alarming Rise of Crypto-Related Violence: How France Became a Hotbed for Wrench Attacks

A disturbing trend is unfolding in France, where crypto-related kidnappings and home invasions, known as 'wrench attacks,' are on the rise. The country has become a focal point for these crimes, with at least 41 incidents reported this year, occurring at a rate of approximately one every two to three days. The French government has taken notice, with Minister Delegate to the Interior Ministry Jean-Didier Berger acknowledging the issue and announcing plans to implement new measures to combat the problem. A prevention platform has already been launched, but authorities concede that more needs to be done to address the growing concern. The rise of wrench attacks in France is part of a larger global trend. According to data from Certik and crypto researcher Jameson Lopp, there were 72 verified physical coercion incidents worldwide in 2025, representing a 75% increase from the previous year. Many of these incidents go unreported, making it difficult to determine the true scope of the problem. The term 'wrench attack' refers to the use of physical force to gain access to digital assets. For some attackers, it is easier to coerce a victim than to attempt to break encryption. The success of these attacks can have a ripple effect, making crypto owners appear as lucrative targets. Unlike traditional bank transfers, crypto transactions are irreversible, allowing attackers to quickly move funds across wallets and chains once a victim is coerced into authorizing a transfer. Researchers have observed a shift in the way attackers identify and target victims. Rather than searching for technical vulnerabilities, attackers are now building profiles of potential targets, tracking their social media activity, public appearances, and leaked datasets to identify points of weakness. 'We're seeing a shift from 'find a wallet' to 'hunt a person,'' said Phil Ariss of TRM Labs. The biggest mistake crypto owners can make is tying their real-world identity, location, and routine too closely to their visible crypto wealth. The problem is exacerbated when attackers receive insider information from government officials. In one notable case, a French tax official sold sensitive data to wrench attackers, raising concerns that insider leaks and compromised state data are fueling these attacks. The pool of potential victims has expanded, with mid-level crypto holders increasingly being targeted. Sometimes, these targets are identified based on limited or indirect signals, making it more challenging for authorities to categorize the severity of the attacks. Cases now involve families, with children being targeted alongside their crypto-holding parents, making the attacks harder to categorize by severity. In January 2025, Ledger co-founder David Balland was kidnapped in France, along with his partner. During the attack, one of his fingers was severed and sent to associates as part of a ransom demand. He was rescued after a police operation. Other cases have involved prolonged captivity and torture, such as one in New York, where a crypto investor was held for more than two weeks. In Canada, a home invasion escalated into waterboarding and sexual violence as attackers attempted to force access to funds. Both opportunistic and organized groups are involved in these attacks, with signs of increasing coordination. 'We do seem to be seeing more organized groups now,' said Lopp. TRM Labs's Ariss has observed similar patterns, noting that some groups operate with defined roles and pre-planning, including surveillance and follow-home tactics. 'These look less like one-off robberies and more like small kidnap or robbery crews specializing in crypto jobs,' Ariss said. After obtaining funds, attackers tend to move quickly, frequently converting the crypto assets into stablecoins and routing them across multiple chains, making recovery more difficult. France's role in this trend may be attributed to a combination of factors, including cases involving leaked personal data and cross-border criminal networks. Rising asset prices have increased the potential payoff from a single attack, while improvements in digital security have reduced the effectiveness of purely technical exploits. 'It's far easier than trying to rob a bank,' Lopp said. Another issue is visibility: wrench attacks might be significantly underreported because many are recorded as standard robberies or home invasions, with no mention of crypto. 'A large share of incidents are still recorded as simple robberies,' Ariss said, adding that the crypto element is often left out at the time of reporting, which can make it harder for authorities to connect cases or identify broader patterns. The increase in attacks has raised questions about the risks of self-custody, a core principle of cryptocurrency. Some security experts point to measures such as multi-signature setups, withdrawal delays, and spending limits as ways to reduce risk by limiting how much can be accessed under duress. 'If coercion cannot produce immediate access to the majority of funds, the risk and return changes,' Ariss said. Such measures do not eliminate the threat but may reduce the incentive for attackers. As crypto adoption grows, attacks are becoming more frequent and severe, turning what was once a niche concern into a broader security risk.