A surge in crypto-related kidnappings and home invasions, known as wrench attacks, has placed France at the center of a global crisis. The country has witnessed at least 41 such incidents this year, occurring at a rate of approximately one every two to three days. This alarming trend prompted government officials to address the issue at an international blockchain and crypto conference in Paris, where they expressed concern over the scale of the problem.
Minister Delegate to the Interior Ministry, Jean-Didier Berger, announced that new measures are being developed in collaboration with Interior Minister Laurent Nuñez to tackle the issue. Although a prevention platform has already garnered thousands of registrations, further action is deemed necessary as incidents continue to escalate. The phenomenon of wrench attacks, which involves the use of physical force to gain access to digital assets, has become a global concern.
According to data from Certik and crypto researcher Jameson Lopp, there were 72 verified physical coercion incidents worldwide in 2025, representing a 75% increase from the previous year. Moreover, cases involving physical assault rose by 250% year-over-year. The term 'wrench attack' refers to the use of physical force to extract access to digital assets, often proving easier for attackers than breaking encryption.
'Every time a wrench attack is successful, it sends a message that crypto owners are vulnerable targets,' Lopp stated. Unlike traditional bank transfers, crypto transactions are irreversible, allowing attackers to quickly move funds across wallets and chains once a victim is coerced into authorizing a transfer. Researchers note that attackers are shifting their strategy from targeting technical vulnerabilities to 'hunting a person.' They build profiles by monitoring social media activity, public appearances, and leaked datasets to identify potential victims. 'The biggest avoidable mistake is linking real-world identity, location, and routine too closely to visible crypto wealth,' said Phil Ariss of TRM Labs.
The problem is exacerbated when attackers receive assistance from government officials, as seen in a case where a French tax official sold sensitive data to wrench attackers. The pool of potential victims has expanded, with mid-level holders being targeted based on limited or indirect signals. Cases now involve families, with children being targeted alongside crypto-holding parents, making it challenging to categorize the severity of the attacks.
In one notable incident, Ledger co-founder David Balland was kidnapped in France along with his partner, and one of his fingers was severed during the attack. Other cases have involved prolonged captivity and torture, such as an incident in New York where a crypto investor was held for over two weeks. Lopp noted that both opportunistic and organized groups are involved, with signs of increasing coordination among attackers.
Ariss observed similar patterns, noting that some groups operate with defined roles and pre-planning, including surveillance and follow-home tactics. After obtaining funds, attackers tend to move quickly, converting crypto assets into stablecoins and routing them across multiple chains to make recovery more difficult. France's role in this trend may be attributed to a combination of factors, including cases involving leaked personal data and cross-border criminal networks.
Rising asset prices have increased the potential payoff from a single attack, while improvements in digital security have reduced the effectiveness of purely technical exploits. 'It's far easier than trying to rob a bank,' Lopp said. The issue of underreporting also exists, as many wrench attacks are recorded as standard robberies or home invasions without mentioning the crypto element. 'A large share of incidents are still recorded as simple robberies,' Ariss said, adding that the crypto element is often omitted at the time of reporting, making it harder for authorities to connect cases or identify broader patterns.
The increase in attacks has raised questions about the risks of self-custody, a core principle of cryptocurrency. Some security experts recommend measures such as multi-signature setups, withdrawal delays, and spending limits to reduce risk by limiting access to funds under duress.
'If coercion cannot produce immediate access to the majority of funds, the risk and return change,' Ariss said. Such measures do not eliminate the threat but may reduce the incentive for attackers. As crypto adoption grows, attacks are becoming more frequent and severe, transforming what was once a niche concern into a broader security risk.