Key Takeaways
- • France accounts for 19 of 72 verified global wrench attacks in 2025, more than double the United States, establishing it as the epicenter of crypto-targeted physical violence according to blockchain security firm CertiK.
- • Wrench attacks—physical assaults to coerce victims into surrendering cryptocurrency private keys—surged 75% in 2025 with 72 confirmed incidents worldwide, representing a 250% increase in physical assaults including home invasions, kidnappings, and murder attempts.
- • Europe now represents over 40% of all wrench attacks globally (up from 22% in 2024), with confirmed losses exceeding $40 million and likely substantially higher unreported losses across the continent.
- • Multiple data breaches targeting French crypto investors have fueled attack patterns: the Waltio breach exposed 50,000 users' crypto holdings data, Ledger disclosed a third major data exposure, and a French tax official was charged with selling investor addresses and asset information to organized crime networks.
- • High-profile victims include Binance France CEO David Prinçay (home invasion, February 2026) and a 74-year-old tortured for 16 hours to extract $3.5 million in crypto, while another case involved five suspects dousing an influencer's father in gasoline for cryptocurrency ransom near the Swiss border in late 2024.
Summary
France has emerged as the global epicenter of "wrench attacks"—violent physical assaults targeting cryptocurrency holders to coerce them into surrendering digital assets. According to blockchain security auditor CertiK, wrench attacks increased 75% in 2025, with 72 confirmed incidents worldwide. France accounted for 19 of these attacks, more than double the United States figure and representing approximately one-third of all global incidents. The attacks have escalated dramatically in scale and brutality, with CertiK documenting a 250% increase in physical assaults including home invasions, kidnappings, torture, and murder attempts. Europe now accounts for over 40% of all wrench attacks globally, compared to 22% in 2024.
The targeting of French crypto holders reflects a confluence of criminal intelligence and network coordination. Organized crime groups have increasingly targeted known cryptocurrency investors across France, Spain, and Sweden. CertiK attributes this concentration partly to what the firm terms the "Technical Paradox": as digital security improves and hacking becomes costlier, criminal networks have shifted to physical coercion as a more reliable extraction method. The confirmed financial losses from these attacks exceed $40 million, with actual losses likely substantially higher due to underreporting.
Multiple data breaches have provided criminals with targeting lists of wealthy crypto investors. In January 2026, hackers breached Waltio, a French cryptocurrency tax platform, exposing data on approximately 50,000 users including email addresses, crypto gains and losses, and year-end balances. The stolen database appeared on dark web marketplaces on December 24, 2025—nearly a month before Waltio detected the breach. Hackers subsequently claimed through BreachForums that the stolen data directly facilitated at least three kidnappings netting criminals $17.1 million combined. Additionally, Ledger disclosed a separate breach through its payment processor Global-e, exposing customer names and contact information, marking the company's third major data exposure since the 2020 incident that leaked 270,000 records. Most alarmingly, a French tax official named Ghalia C. was charged in 2025 with using government tax software to identify and locate cryptocurrency investors, then selling that information to organized crime networks.
Notable attacks illustrate the escalating violence. In February 2026, Binance France CEO David Prinçay's home was invaded by three armed men. A January 2026 case involved three men torturing a 74-year-old for 16 hours to obtain $3.5 million in cryptocurrency from his son, abandoning the scheme only after discovering the son was not a crypto trader. A late-2024 incident near the French-Swiss border saw five suspects (including a 16-year-old at the time) arrest the father of a Dubai-based crypto influencer, dousing him in gasoline and forcing him into a car trunk to extort Bitcoin ransom. Prosecutors charged the alleged perpetrators with kidnapping, unlawful confinement, extortion, organized crime, and aggravated violence. Attack methods have evolved beyond simple robbery to include "honey pot" schemes involving fake romantic relationships used to stage assaults, targeting of family members including spouses and children, and attacks on elderly parents to compel cooperation from crypto-wealthy adult children.
The targeting of French crypto holders reflects a confluence of criminal intelligence and network coordination. Organized crime groups have increasingly targeted known cryptocurrency investors across France, Spain, and Sweden. CertiK attributes this concentration partly to what the firm terms the "Technical Paradox": as digital security improves and hacking becomes costlier, criminal networks have shifted to physical coercion as a more reliable extraction method. The confirmed financial losses from these attacks exceed $40 million, with actual losses likely substantially higher due to underreporting.
Multiple data breaches have provided criminals with targeting lists of wealthy crypto investors. In January 2026, hackers breached Waltio, a French cryptocurrency tax platform, exposing data on approximately 50,000 users including email addresses, crypto gains and losses, and year-end balances. The stolen database appeared on dark web marketplaces on December 24, 2025—nearly a month before Waltio detected the breach. Hackers subsequently claimed through BreachForums that the stolen data directly facilitated at least three kidnappings netting criminals $17.1 million combined. Additionally, Ledger disclosed a separate breach through its payment processor Global-e, exposing customer names and contact information, marking the company's third major data exposure since the 2020 incident that leaked 270,000 records. Most alarmingly, a French tax official named Ghalia C. was charged in 2025 with using government tax software to identify and locate cryptocurrency investors, then selling that information to organized crime networks.
Notable attacks illustrate the escalating violence. In February 2026, Binance France CEO David Prinçay's home was invaded by three armed men. A January 2026 case involved three men torturing a 74-year-old for 16 hours to obtain $3.5 million in cryptocurrency from his son, abandoning the scheme only after discovering the son was not a crypto trader. A late-2024 incident near the French-Swiss border saw five suspects (including a 16-year-old at the time) arrest the father of a Dubai-based crypto influencer, dousing him in gasoline and forcing him into a car trunk to extort Bitcoin ransom. Prosecutors charged the alleged perpetrators with kidnapping, unlawful confinement, extortion, organized crime, and aggravated violence. Attack methods have evolved beyond simple robbery to include "honey pot" schemes involving fake romantic relationships used to stage assaults, targeting of family members including spouses and children, and attacks on elderly parents to compel cooperation from crypto-wealthy adult children.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.