A disturbing trend is unfolding in France, where crypto holders are being targeted in a wave of kidnappings and home invasions, known as wrench attacks, which involve using physical force to gain access to digital assets. The country has witnessed at least 41 such incidents this year, averaging one every two to three days. This alarming rise has prompted government officials to acknowledge the scale of the problem and announce new measures to tackle it, including a prevention platform that has already drawn thousands of registrations. The global rise in wrench attacks is also a cause for concern, with 72 verified physical coercion incidents reported in 2025, representing a 75% increase from the previous year.
Security researchers and law enforcement data indicate that these attacks are becoming more frequent and more violent, with cases involving physical assault rising by 250% year-over-year. The term 'wrench attack' refers to the use of physical force to extract access to digital assets, which can be easier for attackers than breaking encryption.
Unlike traditional bank transfers, crypto transactions cannot be reversed, making it a lucrative target for attackers. Researchers say that attackers are now identifying victims by building profiles, tracking social media activity, public appearances, and leaked datasets, rather than scanning for technical vulnerabilities.
The problem is exacerbated when attackers receive insider information from government officials, as seen in a case where a French tax official sold sensitive data to wrench attackers. The pool of potential victims has widened, with mid-level holders being targeted, sometimes based on limited or indirect signals. Cases now include families, with children being targeted alongside crypto-holding parents, making the attacks harder to categorize by severity. In one notable case, Ledger co-founder David Balland was kidnapped in France, along with his partner, and was rescued after a police operation.
Other cases have involved prolonged captivity, torture, and even waterboarding and sexual violence. Security experts say that both opportunistic and organized groups are involved, with signs of increasing coordination and pre-planning. After obtaining funds, attackers tend to move quickly, converting crypto assets into stablecoins and routing them across multiple chains, making recovery more difficult.
France's role in this trend may be attributed to a mix of factors, including cases involving leaked personal data and cross-border criminal networks. Rising asset prices have increased the potential payoff from a single attack, while improvements in digital security have reduced the effectiveness of purely technical exploits.
The increase in attacks has raised questions about the risks of self-custody, a core principle of cryptocurrency. Security experts recommend measures such as multi-signature setups, withdrawal delays, and spending limits to reduce risk by limiting how much can be accessed under duress.