A disturbing trend is emerging in France, where crypto-related kidnappings, also known as wrench attacks, are on the rise. The country has experienced at least 41 such incidents this year, averaging approximately one every two to three days.
This alarming surge has prompted government officials to acknowledge the scale of the problem and pledge to implement new measures to tackle it. A prevention platform has already been established, with thousands of registrations, but further action is deemed necessary as the number of incidents continues to escalate. The French government is working to address the issue, with Minister Delegate to the Interior Ministry Jean-Didier Berger announcing plans to introduce a new set of measures in collaboration with Interior Minister Laurent Nuñez. The rise in wrench attacks is not limited to France, as security researchers and law enforcement data indicate a global increase in such incidents.
In 2025, there were 72 verified physical coercion incidents worldwide, representing a 75% increase from the previous year. The term 'wrench attack' refers to the use of physical force to gain access to digital assets, often because it is easier for attackers to coerce individuals than to break encryption. According to crypto researcher Jameson Lopp, every successful wrench attack sends a message that crypto owners are vulnerable targets. Unlike traditional bank transfers, crypto transactions are irreversible, allowing attackers to quickly transfer funds across wallets and chains once a victim is coerced into authorizing a transfer.
Researchers have observed a shift in the way attackers identify victims, from targeting technical vulnerabilities to building profiles based on social media activity, public appearances, and leaked datasets. Attackers look for points of weakness, such as routines and patterns, to exploit.
The problem is exacerbated when government officials inadvertently provide attackers with sensitive information, as seen in a case where a French tax official sold data to wrench attackers. The pool of potential victims has expanded, with mid-level holders increasingly being targeted based on limited or indirect signals. Even families are being targeted, with children sometimes being kidnapped alongside crypto-holding parents, making it challenging to categorize the severity of the attacks.
High-profile cases, such as the kidnapping of Ledger co-founder David Balland, have highlighted the brutality of these attacks. Balland was kidnapped in France along with his partner, and during the ordeal, one of his fingers was severed and sent to associates as part of a ransom demand.
He was eventually rescued after a police operation. Other cases have involved prolonged captivity, torture, and even waterboarding and sexual violence.
Security experts believe that both opportunistic and organized groups are involved in wrench attacks, with signs of increasing coordination among the latter. After obtaining funds, attackers tend to move quickly, converting crypto assets into stablecoins and routing them across multiple chains to make recovery more difficult. France's position as a hub for wrench attacks may be attributed to a combination of factors, including leaked personal data and cross-border criminal networks.
The increase in attacks has raised concerns about the risks associated with self-custody, a fundamental principle of cryptocurrency. Security experts recommend measures such as multi-signature setups, withdrawal delays, and spending limits to reduce the risk of wrench attacks by limiting access to funds under duress.
As crypto adoption continues to grow, the frequency and severity of attacks are likely to increase, transforming what was once a niche concern into a broader security risk.