A disturbing trend is emerging in France, where crypto holders are being targeted in increasingly brazen and violent attacks, known as wrench attacks, which involve the use of physical force to gain access to digital assets. This year alone, the country has seen at least 41 crypto-related kidnappings and home invasions, prompting government officials to take action.
The problem is not unique to France, as security researchers and law enforcement data reveal a global rise in wrench attacks, with 72 verified incidents reported in 2025, a 75% increase from the previous year. The term 'wrench attack' refers to the use of physical force to extract access to digital assets, and for some attackers, it is easier to coerce a person than to break encryption. According to crypto researcher Jameson Lopp, 'every time a wrench attack is successful, it tells the world that crypto owners are juicy targets.' Unlike traditional bank transfers, crypto transactions cannot be reversed, making it easier for attackers to quickly move funds across wallets and chains. Researchers say that attackers are now using more sophisticated methods to identify victims, including building profiles based on social media activity, public appearances, and leaked datasets.
They look for points of weakness, such as tying real-world identity, location, and routine too tightly to visible crypto wealth. The problem is exacerbated when attackers get a helping hand from government officials, such as in the case of a French tax official who sold sensitive data to wrench attackers. The pool of potential victims has widened, with mid-level holders increasingly being targeted, sometimes based on limited or indirect signals. Cases now include families, with children targeted alongside crypto-holding parents, making the attacks harder to categorize by severity.
In one notable case, Ledger co-founder David Balland was kidnapped in France along with his partner, and during the attack, one of his fingers was severed and sent to associates as part of a ransom demand. Other cases have involved prolonged captivity and torture, such as one in New York, where a crypto investor was held for more than two weeks. Lopp says that both opportunistic and organized groups are involved, but there are signs of increasing coordination. After funds are obtained, attackers tend to move quickly, and the crypto assets they attain are often converted into stablecoins and routed across multiple chains, making recovery more difficult.
France's role in this trend may reflect a mix of factors, including cases involving leaked personal data and cross-border criminal networks. Rising asset prices have increased the potential payoff from a single attack, while improvements in digital security have reduced the effectiveness of purely technical exploits. The increase in attacks has raised questions about the risks of self-custody, a core principle of cryptocurrency.
Some security experts point to measures such as multi-signature setups, withdrawal delays, and spending limits as ways to reduce risk by limiting how much can be accessed under duress. As crypto adoption grows, attacks are becoming more frequent and severe, turning what was once a niche concern into a broader security risk.