A disturbing trend is emerging in France, where crypto holders are being targeted in a rising number of kidnappings and home invasions, known as wrench attacks, which involve using physical force to gain access to digital assets. This year alone, France has seen at least 41 such incidents, prompting government officials to take action. The country has become a focal point in the global rise of wrench attacks, with security researchers and law enforcement data indicating a significant increase in these types of attacks worldwide.
In 2025, there were 72 verified physical coercion incidents globally, representing a 75% increase from the previous year. The term 'wrench attack' refers to the use of physical force to extract access to digital assets, which can be easier for attackers than attempting to break encryption. Researchers note that attackers are shifting their approach from targeting technical vulnerabilities to building profiles of potential victims, tracking their social media activity, public appearances, and leaked datasets to identify points of weakness.
The problem is exacerbated when attackers receive inside help from government officials, such as in a widely reported case where a French tax official sold sensitive data to wrench attackers. The pool of potential victims has expanded, with mid-level holders increasingly being targeted based on limited or indirect signals.
Cases now include families, with children being targeted alongside crypto-holding parents, making the attacks harder to categorize by severity. In one notable case, Ledger co-founder David Balland was kidnapped in France along with his partner, and during the attack, one of his fingers was severed and sent to associates as part of a ransom demand. He was rescued after a police operation. Other cases have involved prolonged captivity and torture, such as one in New York, where a crypto investor was held for more than two weeks.
Security experts point to measures such as multi-signature setups, withdrawal delays, and spending limits as ways to reduce risk by limiting how much can be accessed under duress. As crypto adoption grows, attacks are becoming more frequent and severe, turning what was once a niche concern into a broader security risk.