Blockchain security has never been more sophisticated. Auditing firms catch smart contract bugs within hours. Multi-signature wallets, hardware signing devices, and zero-knowledge proofs make on-chain theft increasingly difficult for even the most technically capable adversaries.
Yet in the first half of 2026, thieves walked away with $124 million in crypto assets without writing a single line of exploit code
They used wrenches.
CertiK's Intel3D Wrench Attacks Report for H1 2026, released on July 23, 2026, documents a sharp and accelerating rise in physical coercion attacks targeting known or suspected cryptocurrency holders. The figure represents a pace that, if sustained, would nearly double the full-year 2025 total. The data demands serious attention from anyone who holds crypto outside of an exchange, and from the broader industry that has so far treated physical security as someone else's problem.
TL;DR
- Physical coercion attacks against crypto holders totaled $124 million in H1 2026, setting a record pace that threatens to double full-year 2025 losses.
- CertiK's data shows attacks are no longer concentrated in developing markets, North American and European incidents are rising sharply as a share of total cases.
- The industry's obsession with on-chain security has created a blind spot: self-custody without operational security training is now a measurable liability.
- Victim profiles are shifting toward mid-tier holders and public social media users, not just ultra-high-net-worth individuals or exchange executives.
- Hardware wallet adoption, without accompanying physical security practices, may be increasing risk rather than reducing it for the average retail holder.
What CertiK's Wrench Attack Report Actually Measures
The term "wrench attack" entered crypto security vocabulary as a darkly practical joke.
The cryptographer Bruce Schneier formulated the underlying concept decades before crypto existed: if an attacker can apply enough physical pressure, no amount of cryptographic protection matters. In crypto circles, the joke became a meme, then a documented threat category.
CertiK's Intel3D unit tracks physical coercion incidents that result in the transfer of cryptocurrency under duress. This includes home invasions, street robberies, kidnappings, and forced device unlocking at gunpoint. The methodology covers publicly reported incidents, cross-referenced against blockchain forensics where wallet addresses are known, plus law enforcement disclosures across 38 jurisdictions.
The $124 million figure covers January 1 through June 30, 2026. It does not include fraud, phishing, or on-chain exploits. It measures only incidents where physical force or the credible threat of force was used to compel a victim to transfer assets.
The $124 million total for H1 2026 is not a projection, it reflects confirmed or forensically corroborated incidents, meaning the actual figure, accounting for unreported cases, is almost certainly higher.
This is a critical methodological point. Law enforcement reporting rates for crypto-related robbery remain lower than for conventional robbery in most jurisdictions, partly because victims fear regulatory scrutiny of their holdings and partly because recovery prospects are perceived as poor. CertiK's analysts estimate that documented cases represent 60 to 70 percent of actual incidents based on dark web forum chatter and insurance claim patterns.
The true H1 2026 toll may approach $180 to $200 million.
Also Read: AI Kill Switch Act Could Give Trump Administration Power To Shut Models Down
How H1 2026 Compares To Every Prior Year On Record
Contextualizing the $124 million figure requires understanding the trajectory. Physical crypto attacks were a negligible category before 2020. The first systematic tracking, conducted by researcher Jameson Lopp via his personal security incident database, catalogued fewer than 20 documented attacks per year between 2015 and 2018. Losses were measured in hundreds of thousands of dollars at most.
The inflection point came in 2021. Bitcoin (BTC) surpassed $60,000 for the first time, mainstream media ran thousands of stories about crypto millionaires, and the addressable pool of potential victims became, for the first time, meaningfully large. Lopp's database recorded 32 documented physical attacks in 2021, up from 15 in 2020. By 2023, the count exceeded 60. By 2025, it surpassed 100 confirmed incidents globally.
CertiK's methodology captures a wider net than Lopp's individual tracking, which is why the dollar figures diverge. But directionally, both datasets show the same acceleration curve.
At the H1 2026 run rate, annual physical attack losses would reach approximately $248 million, nearly double the estimated full-year 2025 total of $132 million, according to CertiK's prior annual report.
Also Read: ChatGPT Allegedly Nearly Killed A Pastor, And Now A Court Will Hear It
The Geography Of Physical Crypto Crime Is Shifting
The early narrative around physical crypto attacks centered on Latin America and Southeast Asia, regions with high crypto adoption, weaker law enforcement capacity, and existing organized crime infrastructure capable of targeting high-value individuals. That geographic framing is now outdated.
CertiK's H1 2026 data shows the United States and Western Europe collectively accounting for 38 percent of documented incidents by case count, up from approximately 22 percent in 2023.
The United Kingdom, the Netherlands, and Germany have all recorded high-profile cases in 2026.
The US accounted for the largest single-country share at 19 percent of global documented incidents.
This geographic shift has a structural explanation. Regulatory normalization, spot Bitcoin ETF approvals in the US, MiCA compliance frameworks in Europe, has brought crypto wealth into more public view. Institutional holders file public disclosures. Founders and executives appear on conference panels discussing their portfolios. Tax reporting requirements in multiple jurisdictions have created paper trails that, in some cases, sophisticated criminal networks have allegedly accessed to identify targets.
Western Europe and North America now account for nearly 40 percent of physical crypto attacks by case count, up from 22 percent in 2023, representing the fastest-growing geographic segment in CertiK's dataset.
Southeast Asia remains a high-volume region, particularly Thailand, Vietnam, and Indonesia, where several high-profile kidnapping cases made international news in Q1 2026. Latin America, specifically Brazil, Argentina, and Colombia, continues to generate a disproportionate share of street-level robbery incidents involving mobile wallet theft. But the convergence of geographic distribution means this is no longer a problem that wealthy-world crypto holders can dismiss as something that happens elsewhere.
Also Read: Apple's $2,000 Folding iPhone: Everything We Know Ahead Of September
Who Attackers Are Actually Targeting In 2026
The popular image of the wrench attack victim is a publicly known crypto billionaire. That image is increasingly wrong. CertiK's incident profiling for H1 2026 reveals a significant shift toward mid-tier holders, individuals with between $100,000 and $5 million in documented or inferable crypto holdings.
This shift reflects rational criminal economics. Ultra-high-net-worth targets, exchange founders, major fund managers, known public figures, now typically employ dedicated physical security. Many operate under assumed names for blockchain activity.
Attacking them carries high operational risk for attackers. Mid-tier holders, by contrast, often self-custody significant assets, live ordinary residential lives, and have taken few or no physical security precautions. The risk-reward calculation for attackers has tilted decisively toward this demographic.
Social media exposure is a documented precursor in a substantial share of cases.
CertiK's analysis identified that in approximately 43 percent of H1 2026 incidents where pre-attack reconnaissance could be reconstructed, the victim had posted about crypto holdings, showed off hardware wallets, discussed portfolio performance, or attended public crypto events where they were photographed or recorded. Telegram groups, Twitter/X posts, Discord channels, and even LinkedIn profiles referencing crypto roles have all appeared in post-incident forensics.
In 43 percent of H1 2026 cases where pre-attack intelligence could be reconstructed, the victim had publicly signaled crypto holdings through social media, event attendance, or professional profiles.
A secondary target category that has grown significantly in H1 2026 involves crypto exchange employees and customer support staff. Criminal networks have reportedly used social engineering to obtain partial customer data, not enough to drain wallets on-chain, but enough to identify customers who hold large balances and cross-reference their identities with public records. At least six documented H1 2026 incidents in the US and UK involved victims who were targeted following probable insider data correlation, according to CertiK's incident notes.
Also Read: Bitget Adds New Zealand Registration Covering 5 Regulated Money Services
The Self-Custody Paradox: Hardware Wallets May Increase Risk For Some Users
The hardware wallet industry has spent the last decade correctly arguing that keeping crypto off exchanges reduces counterparty risk. The argument is sound in its original context, exchange hacks, insolvencies, and rug pulls have destroyed billions in customer funds. Self-custody genuinely reduces those risks. But CertiK's H1 2026 data surfaces an uncomfortable corollary that the industry has been slow to address.
Hardware wallet ownership is a publicly inferable signal.
Purchases from Ledger, Trezor, Foundation Devices, and other manufacturers have appeared in data breaches, most famously the Ledger customer database breach in 2020, which exposed names, phone numbers, and physical addresses of approximately 270,000 customers.
That data has been circulating in criminal marketplaces ever since and has been cross-referenced against blockchain analytics to estimate wallet balances.
Beyond the breach question, simply owning and discussing hardware wallet use in online forums, review posts, or social channels signals that a person takes self-custody seriously, and therefore probably has assets worth taking. CertiK's analysts note that hardware wallet-related signals appeared in the pre-attack intelligence profile in a statistically meaningful share of H1 2026 cases.
The 2020 Ledger data breach exposed 270,000 customer records including physical addresses, and according to CertiK's H1 2026 incident analysis, those records continue to circulate in criminal networks and appear as precursor data in a measurable share of physical attack cases.
This does not mean hardware wallets are net harmful. It means hardware wallet adoption without accompanying operational security hygiene creates a specific and underappreciated risk profile. The industry's standard educational content, seed phrase backup, passphrase protection, multi-signature setups, addresses on-chain threats almost exclusively. Physical threat modeling has been left almost entirely to the individual user to figure out independently.
Also Read: Kansas City Royals vs. Detroit Tigers: Polymarket And Kalshi Go Dark
Attack Methodologies: How The $124 Million Was Actually Taken
CertiK's incident taxonomy for H1 2026 categorizes attacks across five primary methodologies. Home invasion remains the most common by incident count, accounting for approximately 34 percent of documented cases. Street robbery, typically involving phone snatching followed by coercion, accounts for 28 percent. Kidnapping for ransom, which tends to generate the largest per-incident losses, accounts for 14 percent but represents a disproportionate share of total dollar value.
Targeted vehicle stops, where victims are followed and intercepted while traveling, account for 11 percent. The remaining cases involve other or unclear circumstances.
The kidnapping-for-ransom category deserves particular attention.
Several H1 2026 cases involved organized groups with apparent knowledge of victim wallet balances at the time of attack, suggesting either insider intelligence or sophisticated on-chain analytics combined with identity resolution. In at least two documented cases, victims were held for multiple days while attackers systematically worked through wallet structures, demanding keys to additional addresses as funds were confirmed transferred.
Multi-signature wallet setups appear to have provided meaningful resistance in a subset of cases. Where victims credibly demonstrated that additional co-signers were required to authorize transactions, and those co-signers were unknown to or unreachable by attackers, several documented incidents resulted in aborted attempts or reduced losses. This represents one of the few technical countermeasures with documented real-world effectiveness against physical coercion.
Kidnapping-for-ransom incidents account for just 14 percent of H1 2026 physical attack cases by count but a disproportionate share of total dollar losses, with several cases involving victims held for multiple days while attackers systematically drained wallet structures.
Time-lock mechanisms and duress wallets, a concept involving pre-configured "sacrifice" wallets loaded with a fraction of total holdings to satisfy an attacker, appear in the security research literature but have seen limited real-world testing. Glacier Protocol and similar high-security self-custody frameworks recommend duress wallet configurations, but uptake among general retail users remains extremely low. The gap between available technical countermeasures and their actual adoption mirrors a pattern seen repeatedly in cybersecurity: the users most vulnerable to specific attacks are typically the least likely to implement the mitigations designed to prevent them.
Also Read: SpaceX May Buy Tesla, But Its Own Stock Has Fallen 50% Since June
Law Enforcement Response: What The Case Closure Data Shows
Physical crypto attacks present unusual challenges for law enforcement. Asset recovery from on-chain transfers is theoretically possible, blockchain forensics firms including Chainalysis and Elliptic have supported successful fund tracing in exchange hack cases. But physical coercion cases are structurally different. Attackers typically move funds immediately through mixers, cross-chain bridges, and privacy protocols designed precisely to break forensic trails.
Law enforcement case closure rates for physical crypto attacks are materially lower than for traditional robbery. CertiK's H1 2026 report cites an estimated global clearance rate of approximately 23 percent for physical crypto attack cases, compared to a roughly 47 percent clearance rate for conventional armed robbery in comparable jurisdictions, according to FBI crime statistics. Asset recovery is even rarer. In the documented H1 2026 case set, full or partial fund recovery occurred in fewer than 8 percent of incidents.
The FBI's dedicated crypto crimes unit has expanded capacity in 2026, and several European national police agencies have established specialist teams. But the transnational nature of many cases, attackers operating across borders while moving funds through decentralized infrastructure, creates jurisdictional gaps that slow investigations significantly.
Case clearance rates for physical crypto attacks run at approximately 23 percent globally, roughly half the clearance rate for conventional armed robbery, and full or partial asset recovery occurred in fewer than 8 percent of H1 2026 documented incidents.
There is some regulatory movement. The Financial Action Task Force (FATF) updated its guidance on virtual asset crime in late 2025 to include physical coercion as a distinct category requiring specialized law enforcement training and cross-border cooperation protocols. Several jurisdictions, including Singapore and the UAE, have incorporated physical crypto crime response into their national cyber crime frameworks. But implementation lags guidance, and for now, the practical reality for most victims is that prosecution is uncertain and asset recovery is unlikely.
Also Read: Intel Stock Surges 11% After Q2 Earnings Blow Past Estimates On AI-Driven Demand
What The Insurance Market Says About Quantified Physical Risk
The emergence of physical crypto attack data at scale has created a new actuarial conversation in the specialty insurance market. Lloyd's of London syndicates and several Bermuda-based specialty carriers have been quietly developing physical crypto risk products since 2023. The H1 2026 data will likely accelerate that market's maturation.
Current crypto custody insurance products, offered by carriers including Evertas, Aon, and specialist Lloyd's syndicates, have historically focused on on-chain theft, exchange insolvency, and key loss. Physical coercion coverage has been available but expensive and narrowly scoped. As incident data accumulates, actuaries can price the risk more precisely, which typically leads to broader coverage availability, though whether premiums will be accessible to mid-tier retail holders is a separate question.
The self-custody insurance gap is significant. Institutional custody solutions from Coinbase Custody, BitGo, and Anchorage Digital include coverage frameworks with explicit physical security requirements, SOC 2 compliance, armed guard protocols, geographically distributed key storage. These requirements are meaningful physical risk mitigations, not just paperwork. Retail self-custody, by contrast, involves no external oversight and no coverage requirement, leaving the holder entirely exposed.
Specialty crypto custody insurance from institutional providers includes explicit physical security requirements as coverage conditions, requirements that effectively do not exist for the retail self-custody market, leaving mid-tier holders with the highest relative exposure and the least coverage.
The H1 2026 data may also influence how regulators approach self-custody disclosure requirements. If physical attack risk is quantifiable and concentrated among identifiable holder profiles, active social media users, hardware wallet purchasers, conference speakers, there is a regulatory argument for disclosure frameworks similar to those applied to other high-risk financial activities. This remains speculative, but the data now exists to support that policy conversation in a way it did not two years ago.
Also Read: Amazon Sacrifices Its Nova Staff To Chase Faster AI Wins Amid 30,000 Cuts
What Operational Security Practices Actually Reduce Physical Attack Risk
The security research community has developed a reasonably clear taxonomy of physical risk mitigations that are supported by incident analysis. CertiK's H1 2026 report identifies practices that appear in significantly lower rates among victims compared to the estimated broader holder population, a form of reverse correlation that suggests protective effect.
The highest-correlation protective factor is simply not publicly disclosing crypto holdings. This sounds obvious but is violated constantly. Conference panels, podcasts, social media portfolios, and professional bios routinely include specific portfolio information. Even describing oneself as "a long-term Bitcoin holder since 2017" in a public forum provides attackers with enough signal to begin target assessment, 2017 BTC holders who still hold are statistically likely to be sitting on substantial unrealized gains.
Geographic consistency practices, not maintaining predictable location routines, varying routes, avoiding disclosure of home neighborhoods on public profiles, appear as a secondary protective factor in incident analysis. Physical security hardware, reinforced entry points, alarm systems, cameras, appears in a smaller subset of cases, suggesting it has some deterrent effect on home invasion targeting but does not fully prevent determined attacks.
Incident analysis from CertiK's H1 2026 dataset suggests that refraining from public disclosure of crypto holdings is the single highest-correlation protective factor, reducing inferable targeting risk more than any technical wallet configuration.
Multi-signature setups involving geographically separated co-signers represent the technical mitigation with the strongest documented real-world protective effect.
When a victim can credibly demonstrate that no single location or person controls enough keys to authorize a transfer, the attack's core economics break down. The mitigation is not foolproof, attackers have in documented cases attempted to locate and coerce co-signers, but it introduces enough friction to deter a meaningful share of opportunistic attacks.
The security research organization Rekt HQ and independent researchers including Lopp have published practical operational security guides that address physical threat models.
These resources exist but remain vastly underutilized relative to the population of self-custody holders they could protect. Industry wallets, hardware device manufacturers, and exchanges that promote self-custody have broadly declined to make physical security education a prominent part of their user onboarding.
Also Read: Prediction Markets Get Another Fire Season As Very Strong El Nino Odds Hit 81%
What The Industry Must Acknowledge About Its Own Role
The crypto industry's response to the $124 million H1 2026 figure has been muted. No major hardware wallet manufacturer, exchange, or industry association has issued a statement or updated user safety guidance in the wake of the CertiK report. The contrast with how the industry responds to on-chain exploits, detailed post-mortems, emergency community calls, immediate protocol patches, is stark.
This response gap reflects a structural incentive problem. On-chain security failures damage protocol reputations and can trigger regulatory scrutiny. Physical attacks against users generate sympathy but no direct reputational liability for the platforms and products those users chose. A user who loses funds in a protocol hack generates headlines that name the protocol. A user who loses funds at knifepoint in their own home generates a local police report.
The industry's self-custody advocacy, "not your keys, not your coins", has been enormously successful as a cultural norm. That norm has driven hundreds of millions of dollars in hardware wallet sales and contributed to billions in assets moving off exchanges. But the advocacy has never been paired with a comparable campaign around physical operational security. The message has been incomplete in a way that is now measurable in lost funds and, in some documented cases, physical harm to individuals.
The crypto industry's self-custody advocacy has been highly effective at shifting assets off exchanges but has not been paired with physical operational security guidance, an omission that CertiK's $124 million H1 2026 figure now quantifies directly.
There are signs this may be beginning to change. Ledger introduced a security tips section to its website in early 2026 covering some physical threat scenarios. Several crypto-native security firms including Casa have built physical threat modeling into their multi-signature product onboarding flows. The Bitcoin Security University project, a community-led educational initiative, added a dedicated physical security curriculum module in Q2 2026. These are meaningful steps. They are also proportionally small relative to the scale of the documented and growing problem.
Read Next: Kane Signs An $8M Chicago Deal, But Kalshi Still Ranks Florida First
Final Thoughts
The $124 million in physical crypto attack losses recorded in H1 2026 is not an anomaly. It is the predictable output of a system in which cryptographic security has advanced rapidly while physical security culture has barely moved.
The industry successfully hardened on-chain infrastructure against sophisticated adversaries. In doing so, it redirected determined thieves toward the one attack vector that no cryptography can defend: the person holding the keys.
CertiK's data marks a threshold moment.
Physical attack losses are now large enough, geographically distributed enough, and demographically broad enough to constitute a systemic risk for the self-custody ecosystem. The mid-tier retail holder, not the billionaire founder, not the institutional custodian, is the primary victim profile of 2026. That is the holder the industry most loudly encouraged to take self-custody. The educational obligation that comes with that encouragement remains largely unmet.