A surge in crypto-related kidnappings has put France under international scrutiny, prompting government officials to take action against the escalating problem. This year, the country has experienced at least 41 crypto-related kidnappings and home invasions, occurring at a rate of approximately one every two to three days. In response, a new set of measures is being developed by Minister Delegate to the Interior Ministry, Jean-Didier Berger, and Interior Minister Laurent Nuñez to tackle the issue. A prevention platform has already been launched, attracting thousands of registrations, but further steps are necessary as incidents continue to rise.
The term 'wrench attack' refers to the use of physical force to gain access to digital assets, which can be an easier method for attackers than attempting to break encryption. According to security researchers and law enforcement data, wrench attacks are becoming more frequent and violent globally, with 72 verified physical coercion incidents reported in 2025, representing a 75% increase from the previous year.
Many cases go unreported, making it challenging to determine the true extent of the problem. The trend is attributed to the fact that crypto transactions cannot be reversed, allowing attackers to quickly move funds across wallets and chains once a victim authorizes a transfer under duress.
Researchers have observed a shift in the way attackers identify victims, from targeting technical vulnerabilities to building profiles based on social media activity, public appearances, and leaked datasets. This approach enables attackers to identify points of weakness and track routines, making it essential for crypto owners to avoid tying their real-world identity, location, and routine to visible crypto wealth. The problem is exacerbated when attackers receive assistance from government officials, such as in a case where a French tax official sold sensitive data to wrench attackers.
The pool of potential victims has expanded, with mid-level holders being targeted, sometimes based on limited or indirect signals. Cases now include families, with children being targeted alongside crypto-holding parents, making it challenging to categorize the severity of the attacks.
Notable cases include the kidnapping of Ledger co-founder David Balland in France, who was rescued after a police operation, and a crypto investor in New York, who was held for more than two weeks. Security experts, such as Jameson Lopp and Phil Ariss of TRM Labs, note that both opportunistic and organized groups are involved in wrench attacks, with signs of increasing coordination and pre-planning.
After obtaining funds, attackers tend to move quickly, converting crypto assets into stablecoins and routing them across multiple chains, making recovery more difficult. The rise of wrench attacks in France may be attributed to a combination of factors, including leaked personal data and cross-border criminal networks.
As crypto adoption grows, the frequency and severity of attacks are increasing, turning a once niche concern into a broader security risk. To mitigate this risk, security experts recommend measures such as multi-signature setups, withdrawal delays, and spending limits to reduce the incentive for attackers by limiting access to funds under duress.