France Charges 88 People Over 12 Alleged Crypto Wrench Attacks

France has emerged as the global center of so-called wrench attacks, in which criminals bypass digital security by kidnapping, assaulting or threatening crypto holders and their relatives until assets are transferred. That risk makes tax records unusually sensitive: names, addresses and income data can help attackers identify and locate wealthy targets. The breach at the Direction générale des Finances publiques, or DGFiP, therefore raises concerns beyond phishing and identity theft, though authorities have not said the compromised records specifically identify cryptocurrency investors.

DGFiP said attackers used stolen identities for an employee and an authorized third party to enter its systems in June and July 2026. After claims surfaced on Aug. 12 and 13, investigators found records on about 678,000 individuals and businesses had been viewed and extracted, including income, withholding-tax and property data; the agency notified France’s privacy regulator, CNIL. Interior Minister Laurent Nuñez said France recorded 77 crypto-linked kidnappings, detentions, extortion cases and attempts in the first half, up from 45 in all of 2025. CertiK separately verified 33 French wrench attacks among 52 worldwide, with global financial exposure reaching $124.1 million.

Crypto “wrench attacks” use kidnapping, assault or other physical threats to force holders to surrender private keys or transfer digital assets. The tactic exploits a defining feature of cryptocurrency: blockchain transactions are generally irreversible, leaving victims with limited options once funds are sent. Criminal groups are also targeting relatives and other people close to wealthy holders, turning personal security into a growing risk alongside hacking and online fraud.

More than $30 million in cryptocurrency was stolen through violent attacks in the first half of 2026, according to a report from blockchain analytics firm Chainalysis, putting the year on pace for a record. The cases increasingly involved home invasions and threats against victims’ friends or family members. France recorded the largest number of publicly reported incidents through June 2026, emerging as the leading hotspot for such attacks.

A “wrench attack” involves criminals using kidnapping, assault or coercion to force cryptocurrency holders to surrender private keys or transfer digital assets. France has drawn attention because of its high concentration of such cases. After Ledger’s 2020 customer data breach, centrally stored personal information including names, telephone numbers and home addresses may have been used to target victims, highlighting the physical security risks associated with KYC requirements.

A recent report said about 70% of physical attacks involving cryptocurrency worldwide occur in France. The country has recorded 41 related kidnappings so far in 2026. Experts say past customer data breaches at companies such as Ledger have made it easier for criminal groups to identify cryptocurrency holders and their homes. The cases show that the centralized exposure of identity data collected under regulatory requirements can extend digital-asset risks to personal safety.

A “wrench attack” is a physical crime in which perpetrators use kidnapping, beatings or death threats to force cryptocurrency holders to surrender their wallet seed phrases or private keys. Such targeted attacks have increased globally since 2025 because blockchain transfers are difficult to reverse and assets can be moved quickly, underscoring the personal-security risks associated with self-custody.

The US Justice Department recently charged three Tennessee men with traveling across state lines to California, posing as delivery workers to enter a home and using violence and threats to force the victim to surrender a cryptocurrency seed phrase. Prosecutors said the three stole about $6.5 million in crypto assets. The case has been classified as an interstate “wrench attack” targeting a cryptocurrency holder.

So-called wrench attacks use kidnapping, beatings or firearms to force holders to surrender their wallet keys, bypassing digital safeguards altogether. Known cases worldwide rose 75% to 72 in 2025, with France reporting more than any other country. At least 41 cases had already been recorded by April 2026, or about one every 2.5 days, underscoring how leaked identities or addresses can translate into physical danger.

On April 11, 2026, a 40-year-old crypto industry worker in Saint-Jean-de-Védas, near Montpellier, opened his door to receive a delivery. A 25-year-old suspect posing as a delivery driver forced his way inside, held the man, his wife and their children at gunpoint, and demanded the wallet's private keys. The victim seized an opportunity to grab the gun, which discharged during the struggle, but no one was injured and nothing was stolen. Investigators from the French National Gendarmerie's Montpellier unit arrested the suspect after a three-day search. Judicial authorities in Montpellier charged him with attempted armed robbery and remanded him in custody.

A “wrench attack” involves criminals using physical violence, including kidnapping and assault, to force holders to surrender wallet keys or transfer assets. France’s digital asset industry association ADAN estimates that about 11% of the country’s population, or roughly 7.3 million people, own cryptocurrency. The concentration of companies such as Ledger and the heightened risk of personal-data leaks have made holders and their families targets, while undermining France’s efforts to establish itself as a crypto industry hub.

French Interior Ministry representative Jean-Didier Berger announced stronger protections at Paris Blockchain Week on April 14, 2026. That same month, the wife and child of a leading industry figure in Burgundy were kidnapped, with the perpetrators demanding €400,000. Interior Minister Laurent Nuñez said on June 30 that 77 related cases had been recorded since the start of the year, up from 45 in all of 2025. A prevention platform had registered 724 people, while the initiative had led to 200 arrests.