// Contents
In February 2009, Randall Munroe drew a two-panel comic . In the first panel, a crypto nerd daydreams: his laptop is protected by 4096-bit encryption, the villains build a million-dollar cluster to crack it, and they give up. The second panel shows what would actually happen. They drug the owner and hit him with a $5 wrench until he gives up the password.
Seventeen years later, the joke reads like a police log. On the night of September 19, 2026, four men in balaclavas walked into a house in Vendin-le-Vieil, a small town in northern France. They tied up the parents and their two children , aged eight and twelve, took the father into a separate room and forced him to transfer about €40,000 in crypto. The father works in the crypto industry. Nobody hacked a single password.
This kind of crime has a name: the wrench attack. It also has a world leader that few people would guess on the first try. Not the United States, not Brazil, but France. In July, near Paris, three men tied up another family, reportedly on a tip from a leaked database of a crypto tax service. The wallet held about €100.
The comic that became a spreadsheet
Since 2018, American developer Jameson Lopp has kept a public list of physical attacks on people who hold crypto, going back to 2014. He is on it himself. In October 2017, a fake emergency call sent a police SWAT team to his home in North Carolina, and someone tried to extort him. The trick is called swatting.
The first entry is Hal Finney. In January 2009 he received the very first bitcoin transaction from the network’s creator, Satoshi Nakamoto. By 2014, ALS had left him almost completely paralysed. In the last year of his life, extortionists called his family demanding 1,000 bitcoin. Then police stormed the house on a hoax call.
After that the entries pile up. The list holds 22 cases for 2017 and 167 for 2025. By October 22, 2026, it had 133 for this year, 50 of them in France: twice as many as France had in all of 2025. Lopp warns that the list is incomplete, because many attacks never get reported.
CertiK’s July report shows the main shift at a glance. Home invasions rose to 20 in six months, from one a year earlier, and are now the most common type of these attacks. The robbers stopped waiting for victims on the street and came to their homes.
Chainalysis counted more than $30 million actually stolen. But of the 46 attacks the firm tracked, the robbers got paid in only 12, or 26%. In 2025 the figure was 49%. More violence, less loot.
Your own bank, your own vault
Crypto’s favourite slogan is “be your own bank”. Coins on a hardware wallet, a USB-stick-sized device that holds the keys, survive an exchange going bust or getting hacked. But that bank has no guards and no vault at another address. The safe is in the bedroom, and the combination is in the owner’s head.
Ordinary money is bad loot for a robbery at gunpoint. Banks set limits, flag odd transfers, and payments can be disputed. A bitcoin transfer is final: there is no help desk that sends the money back. Police sometimes manage to freeze part of the stolen funds at exchanges, but that is a chase, not an undo button.
There is a third reason. The blockchain is public, and anyone can see the balance of any address. Link an address to a name, and a robber knows more about the victim’s money than the neighbours do.
Why France
On June 30, 2026, Interior Minister Laurent Nuñez called the country “something of an epicentre” of these attacks. The 77 cases he cited for six months exceed CertiK’s worldwide total because police also see attempts and cases the press never covered. Nuñez said emergency measures had led to 200 arrests, and 724 people from the crypto industry had signed up for a rapid police alert system.
The turning point came in January 2025. David Balland, a co-founder of the French hardware wallet maker Ledger, was kidnapped with his wife from their home in central France. The kidnappers cut off part of his finger and sent a video to another co-founder. Police freed Balland the next day.
In May 2025, an attack was caught on camera. In the middle of Paris, masked men tried to force into a van painted like a delivery truck the daughter and baby grandson of Pierre Noizat, head of the crypto exchange Paymium. Her partner fought them off until they fled.
Chainalysis sees leaks as the main driver of the French surge. Investigators allege that a tax office employee in Bobigny searched the tax database for crypto investors and sold their details to criminals. She was arrested at the end of June 2025.
In January 2026, hackers breached Waltio, a French service that helps crypto investors with their tax returns. Customer email addresses leaked along with their balances as of the end of 2024. According to French press reports, that file guided the three men who burst into a house in Taverny near Paris on July 13, 2026. They tied up the mother and her ten-year-old child and tased the father until he gave up his codes.
The data was a year and a half old. The wallet held about €100. So the attackers demanded two transfers of €450 each from the wife. In September, six suspects were charged with armed extortion by an organised gang.
The safe is in the bedroom, and the combination is in the owner’s head.
They come for the wrong people
CertiK notes that robbers increasingly go after the coin holder’s family rather than the holder: parents, spouses, children. By the firm’s count, in more than half of cases a relative of the main target becomes a victim or a pressure point.
In the early hours of February 5, 2026, near Grenoble, kidnappers took a 35-year-old judge and her 67-year-old mother. They demanded a crypto ransom from her partner, a co-owner of a crypto start-up, who was not at home. The women were found injured in a garage in the next department: they had untied themselves and called a neighbour for help. No ransom was paid.
Sometimes it is simpler: the gang gets the address wrong. On February 12, 2026, a crew went to the home of the head of Binance France, found him out and left with two phones. A couple of hours later the same men went looking for another crypto entrepreneur, picked the wrong house and hit the woman who lived there on the head with a rifle butt. In August, near Rennes, attackers held and beat the tenants of a house rented from a crypto holder. He was not there.
Who is behind the door
The typical attacker looks nothing like a film gangster. Colonel Christelle Tarrolle heads one of the gendarmerie’s investigation units. According to her figures, which the gendarmerie relayed on October 7, 2026, 16% of those hired for these kidnappings are minors and 70% are between 18 and 29.
They are recruited on WhatsApp, TikTok, Snapchat and Telegram. Many come from drug dealing, but some are students with clean records who agree to be drivers without always understanding what they have signed up for. In the case of the kidnapped judge, six young people were charged , one of them a minor.
What emerges is a kind of courier service for violence. The organiser often sits far away and gives orders in a messaging app, while the hired hands change from job to job. So the gendarmes chase two targets at once: the foot soldiers in France and the organisers abroad.
A safe with a time lock
Shops have long used time-lock safes: the cashier cannot open them early, however nicely someone asks. Protection against the wrench works the same way. The goal is not to hide the password but to make fast access to the money impossible.
CertiK recommends multisig wallets and withdrawal delays for large holders. Multisig means a transfer needs signatures from several keys kept in different places or by different people. Under threat, one person still cannot move everything. A delay forces robbers to hold a victim for hours or even days, which raises the chance that someone interrupts them.
The guide in Lopp’s repository adds a decoy wallet. It is a believable wallet with a small balance and a memorised PIN that can be handed over without exposing the main funds. The same guide advises keeping the main stash away from home and never linking exchange accounts to public social media profiles.
For an ordinary person with a couple of thousand euros in a wallet, the rule is duller. Do not brag about your coins online, and remember that any service that knows your balance may leak one day. The Taverny case shows that a robber needs no more than a line in an old spreadsheet.
Crypto was invented to cut out the middleman. The bank looked like a needless link between people and their money. It turns out that the boring middleman had a job nobody thought about: its vault was not in your house.
