“Criminals have recognized that crypto holders are high-value targets because they possess wealth in an instantly and irreversibly transferrable form,” the Chainalysis report said.
Chainalysis mid‑year figures: $30m in direct losses, $107m including attempts
On August 6, Chainalysis published new findings from its forthcoming mid‑year crypto crime report showing a sharp rise in violent, physical thefts of cryptocurrency. The firm estimated that so‑called “wrench attacks” — home invasions, kidnappings and hostage situations — amounted to roughly $30 million in outright losses during the first half of 2026. When the analysis includes “attempted extractions” such as ransoms and funds that were stolen but subsequently blocked, the figure rises to $107 million.
Wrench attacks: kidnappings steady, home invasions surge
The report breaks wrench attacks into forms and trends. Kidnappings accounted for 53% of the total funds lost to this class of attack — a share the report described as "pretty stable." By contrast, home invasions rose sharply as a share of incidents, now making up 37% of wrench attack incidents compared with 26% in 2023.
Chainalysis explains the rise in home invasions by distinguishing the operational tradeoffs attackers face: “Home invasions allow criminals to confront victims in a controlled environment where they can compel a transfer of funds,” the report noted. “Kidnappings, by contrast, are much more difficult to execute. Attackers must expend considerable time and resources planning logistics; and the extended periods spent with victims leaves the attacker exposed for longer.”
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageFrance, leaked tax data and attacks on relatives
Chainalysis identifies France as the country most affected by these violent thefts. The report links France’s outsized exposure in part to a 2024 data breach in which a local tax official is said to have stolen and sold information on high‑net‑worth crypto holders. The breached dataset reportedly included names, addresses, holdings, phone numbers and tax records.
Attackers have adapted their tactics, increasingly targeting family members to force payments from crypto holders. Chainalysis reports that in France, more than 40% of incidents in the first half of 2026 targeted a relation.
Three attacker profiles: unsophisticated, sophisticated, criminally embedded
- Unsophisticated attacks: Opportunistic transfers of stolen funds directly to centralized exchanges without attempts to obfuscate flows. Chainalysis says these are the easiest for law enforcement to trace.
- Sophisticated attacks: Carried out by crypto‑aware thieves who use decentralized exchanges, bridges, MEV bots and other DeFi tools to swap and move assets across chains — specifically avoiding centralized exchanges because those platforms enforce strict know‑your‑customer checks.
- Criminally embedded attacks: Comparable in technical ability to sophisticated attacks but tied to broader organized crime networks. Chainalysis cites a case where stolen funds ended up in an over‑the‑counter (OTC) laundering service linked to cartels and terrorist financing.
What this means for technologists, policymakers, and the public
Technologists and security teams will be watching transaction patterns that the report flags — flows into decentralized exchanges, bridges, MEV activity and OTC venues — because those chains of movement mark the difference between traceable and hard‑to‑follow thefts. The report’s distinctions underscore how attackers choose tools to evade centralized KYC controls.
Policymakers and regulators will likely focus on the downstream consequences of data exposures: Chainalysis ties France’s elevated victimization in part to a 2024 leak of tax‑office data that included names, addresses, holdings, phone numbers and tax records, a linkage that makes public‑sector data protection a clear policy interest.
Members of the public — especially those identified as high‑net‑worth crypto holders or with family members who might be targeted — face a changed risk environment. The report documents a shift toward confronting holders in controlled physical settings and toward attacking relatives to force transfers, a pattern that elevates personal and familial risk.
Chainalysis’s mid‑year snapshot frames a stark development: violent theft is no longer on the fringes of crypto crime, and attackers are combining physical coercion with a range of on‑chain tactics to move and hide funds. The report leaves two practical questions at the center of any response: how to prevent the sale or exposure of identifying data like the 2024 tax‑office breach, and how to trace and disrupt the on‑chain laundering chains that move funds into decentralized rails or OTC services tied to organized crime. Both will shape the next phase of investigative and policy work.
