Cryptocurrency theft is increasingly moving beyond the digital realm, with criminals resorting to physical violence, threats, home invasions, and kidnappings to force victims into unlocking their crypto wallets or approving transfers under duress. These incidents, known as ‘wrench attacks,’ involve bypassing strong encryption by directly targeting the individuals who control the keys.
Instead of attempting to defeat a wallet’s security through technical means, attackers coerce the owner into granting access. Analysts at TRM have identified a growing pattern of physical attacks against individuals associated with digital asset wealth, including investors, traders, company leaders, and their relatives. This trend underscores how public exposure of cryptocurrency holdings can translate into real-world safety risks.
Such attacks have been reported in countries including France, the United States, the United Kingdom, and Canada. They blur the line between cybercrime and conventional violent crime, compelling victims and security teams to reconsider how wallet access is protected.
TRM noted that criminals find cryptocurrency an attractive target due to the rapidity of transfers and the difficulty victims face in reversing transactions. A wrench attack does not rely on malware, phishing, or software vulnerabilities. Instead, the attacker uses intimidation or physical force to compel the victim to reveal a password, unlock a device, hand over a hardware wallet, or authorize a transaction. The term ‘wrench attack’ originates from a well-known concept in security discussions: even the most robust encryption can fail to protect assets if a criminal can physically threaten the person holding the secret.
France has become a notable example of this danger. In May 2025, masked attackers reportedly attempted to abduct the daughter and grandson of a cryptocurrency chief executive in Paris, but the attempt was thwarted after relatives and bystanders intervened. Earlier that month, the father of a crypto entrepreneur was abducted in Paris, with the perpetrators demanding a ransom reportedly between EUR 5 million and EUR 7 million. The victim was later rescued after 58 hours, and police arrested five suspects. The report also cited the January 2025 kidnapping of Ledger co-founder David Balland and his partner from their home in central France. Attackers demanded EUR 10 million and allegedly injured Balland to pressure compliance before both victims were rescued.
Similar cases have emerged elsewhere. In the United States, prosecutors alleged that members of a criminal operation tracked individuals believed to own large crypto balances, including a July 2024 burglary involving the theft of a hardware wallet from a New Mexico home. Criminals may combine online surveillance with physical targeting. Social media posts, public wallet discussions, travel habits, family details, and visible displays of wealth can all help attackers build a profile before approaching a potential victim. This approach differs sharply from typical online wallet compromises, such as fake crypto wallet applications designed to drain funds without face-to-face contact. In wrench attacks, the victim’s personal safety becomes the immediate point of failure.
TRM emphasized that a common thread in many cases is the profiling of victims before an offense takes place. Individuals who openly discuss holdings, post wallet-related activity, or connect their identity with substantial assets may face a higher risk of being targeted. The first practical step is discretion. Crypto holders should avoid publicly linking wallet addresses to their identity and should be cautious about sharing investment success, travel plans, home details, or family information on social platforms.
As cryptocurrency adoption grows, so does the need for heightened awareness of physical security risks. Users must recognize that their digital wealth can make them targets in the physical world. Implementing robust personal security measures, maintaining discretion about holdings, and being vigilant about sharing personal information are crucial steps in mitigating the risk of wrench attacks.
