A surge in crypto-related kidnappings and home invasions, known as wrench attacks, has placed France under international scrutiny. The country has experienced at least 41 such incidents this year, occurring at a rate of approximately one every two to three days. This trend was evident during a recent international blockchain and crypto conference in Paris, where enhanced security measures were visible, including a police motorcade for VIP guests and reinforced security at the conference venue. Government officials acknowledged the scale of the problem, announcing plans for new measures to tackle the issue, including a prevention platform that has already garnered thousands of registrations.
The global rise in wrench attacks, which involve the use of physical force to gain access to digital assets, has been tracked by security researchers and law enforcement data. In 2025, there were 72 verified physical coercion incidents worldwide, marking a 75% increase from the previous year.
The term 'wrench attack' refers to the use of physical force to extract access to digital assets, which can be easier for attackers than breaking encryption. Successful wrench attacks send a message that crypto owners are vulnerable targets. Unlike traditional bank transfers, crypto transactions are irreversible, allowing funds to be quickly moved across wallets and chains once a victim authorizes a transfer under duress. Attackers are shifting their approach from targeting technical vulnerabilities to building profiles of potential victims, tracking their social media activity, public appearances, and leaked datasets to identify points of weakness.
The biggest avoidable mistake is tying real-world identity, location, and routine too closely to visible crypto wealth. The problem is exacerbated when attackers receive assistance from government officials, such as in a case where a French tax official sold sensitive data to wrench attackers. The pool of potential victims has expanded, with mid-level holders being targeted based on limited or indirect signals. Families, including children, are being targeted alongside crypto-holding parents, making the attacks harder to categorize by severity.
Notable cases include the kidnapping of Ledger co-founder David Balland in France, who was rescued after a police operation, and other cases involving prolonged captivity, torture, and severe violence. Both opportunistic and organized groups are involved, with signs of increasing coordination and pre-planning, including surveillance and follow-home tactics.
After obtaining funds, attackers quickly move and convert crypto assets into stablecoins, routing them across multiple chains to make recovery more difficult. France's role in this trend may be due to a mix of factors, including leaked personal data and cross-border criminal networks.
Rising asset prices have increased the potential payoff from a single attack, while improvements in digital security have reduced the effectiveness of purely technical exploits. Wrench attacks may be underreported, as they are often recorded as standard robberies or home invasions without mentioning crypto. The increase in attacks has raised questions about the risks of self-custody, a core principle of cryptocurrency.
Security experts recommend measures such as multi-signature setups, withdrawal delays, and spending limits to reduce risk by limiting access to funds under duress. As crypto adoption grows, attacks are becoming more frequent and severe, turning a niche concern into a broader security risk.