Key Takeaways
- • French authorities have indicted 88 individuals, including 10 minors, in connection with crypto "wrench attacks"—violent kidnappings and home invasions targeting cryptocurrency holders for asset extraction.
- • France accounts for approximately 70% of all global crypto wrench attacks, with 41 crypto-related kidnappings reported and 67 incidents documented in 2025, establishing the country as the global epicenter of this emerging crime category.
- • High-profile victim David Balland, co-founder of Ledger crypto wallet, was kidnapped from his home in Vierzon with a $10 million ransom demand; French special forces rescued him after 24+ hours, during which attackers severed one of his fingers.
- • Physical attacks on crypto industry figures surged 41% in the first quarter of 2026 compared to 2025, with 34 documented incidents resulting in over $101 million in publicly reported cryptocurrency thefts—significantly exceeding 2025's total of $52 million from 81 attacks.
- • The spike in violent crypto crime reflects a strategic shift by criminal organizations from cyber theft toward physical coercion, exploiting the industry's concentration of high-net-worth individuals and the difficulty of tracing blockchain-based assets once extracted.
Summary
France has emerged as the global epicenter of "wrench attacks"—a violent crime category involving kidnappings, home invasions, and physical assault of cryptocurrency holders to extort digital assets. On June 15, 2026, French authorities announced the indictment of 88 individuals, including 10 minors, in connection with multiple crypto-related extortion cases. According to Vanessa Perrée, France's national prosecutor for organized crime, these charges represent a coordinated law enforcement response to an unprecedented surge in organized criminal activity targeting the crypto industry.
The most prominent victim of this crime wave is David Balland, co-founder of Ledger SAS, a leading cryptocurrency wallet provider. Balland was kidnapped from his home in the French town of Vierzon in the early hours of a Tuesday, with attackers demanding a $10 million ransom. French special forces conducted a manhunt and rescued Balland after more than 24 hours in captivity; his wife was freed approximately 24 hours later. During the ordeal, hostage takers severed one of Balland's fingers—an escalation that underscores the brutality characterizing these attacks. The kidnapping sent shockwaves through the cryptocurrency industry, forcing executives and high-net-worth digital asset holders to confront personal security vulnerabilities.
The scale of the problem extends far beyond isolated incidents. According to a Certik security report, France documented 70% of all crypto wrench attacks globally, with 41 crypto-related kidnappings and 67 total incidents recorded in 2025. In the first quarter of 2026 alone, 34 physical attacks were documented—a 41% increase compared to the equivalent period in 2025. These attacks resulted in publicly reported cryptocurrency thefts exceeding $101 million in the first quarter of 2026, compared to $52 million across all of 2025's 81 documented attacks. Security analysts believe these figures significantly underestimate actual incident frequency, as many victims avoid police reports due to reputational concerns or fear of regulatory scrutiny.
The rise of wrench attacks represents a strategic reorientation by organized crime toward physical violence and extortion rather than purely cyber-based theft. The term derives from a 2014 internet cartoon depicting criminals using a wrench to extract computer passwords from victims. In the crypto context, attackers exploit the industry's concentration of newly wealthy individuals and the pseudonymous, difficult-to-trace nature of blockchain transactions. Industry data from Chainalysis indicates that $3.4 billion in cryptocurrency was stolen through cyber attacks, scams, and fraud in 2025; physical assault now represents an emerging vector that authorities and industry participants view as requiring urgent coordinated response across European jurisdictions.
The most prominent victim of this crime wave is David Balland, co-founder of Ledger SAS, a leading cryptocurrency wallet provider. Balland was kidnapped from his home in the French town of Vierzon in the early hours of a Tuesday, with attackers demanding a $10 million ransom. French special forces conducted a manhunt and rescued Balland after more than 24 hours in captivity; his wife was freed approximately 24 hours later. During the ordeal, hostage takers severed one of Balland's fingers—an escalation that underscores the brutality characterizing these attacks. The kidnapping sent shockwaves through the cryptocurrency industry, forcing executives and high-net-worth digital asset holders to confront personal security vulnerabilities.
The scale of the problem extends far beyond isolated incidents. According to a Certik security report, France documented 70% of all crypto wrench attacks globally, with 41 crypto-related kidnappings and 67 total incidents recorded in 2025. In the first quarter of 2026 alone, 34 physical attacks were documented—a 41% increase compared to the equivalent period in 2025. These attacks resulted in publicly reported cryptocurrency thefts exceeding $101 million in the first quarter of 2026, compared to $52 million across all of 2025's 81 documented attacks. Security analysts believe these figures significantly underestimate actual incident frequency, as many victims avoid police reports due to reputational concerns or fear of regulatory scrutiny.
The rise of wrench attacks represents a strategic reorientation by organized crime toward physical violence and extortion rather than purely cyber-based theft. The term derives from a 2014 internet cartoon depicting criminals using a wrench to extract computer passwords from victims. In the crypto context, attackers exploit the industry's concentration of newly wealthy individuals and the pseudonymous, difficult-to-trace nature of blockchain transactions. Industry data from Chainalysis indicates that $3.4 billion in cryptocurrency was stolen through cyber attacks, scams, and fraud in 2025; physical assault now represents an emerging vector that authorities and industry participants view as requiring urgent coordinated response across European jurisdictions.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.