CertiK logged 52 verified «wrench attacks» targeting crypto holders in the first half of 2026, with total recorded financial exposure reaching $124.1 million, according to the firm's Intel3D H1 2026 Wrench Attacks Report published July 22.
The attack count rose 33.3% from 39 cases in the same period of 2025. Financial exposure, though, jumped far more sharply: from roughly $10.5 million a year ago, a 1,079% increase. Average exposure per incident climbed from about $270,000 to $2.39 million.
France at the center, home invasions on top
Europe accounted for 39 of the 52 verified incidents, or 75% of the global total. France alone recorded 33 cases in CertiK's dataset, equal to 63.5% of all verified attacks worldwide. France's National Directorate of Judicial Police separately logged 41 incidents between January and March, suggesting CertiK's public dataset may undercount the actual French total. The U.S. recorded four incidents; Sweden and the UK recorded two each.
Home invasions emerged as the single most common attack type, rising from one case in H1 2025 to 20 in H1 2026. CertiK's $124.1 million figure covers stolen funds, ransom demands, frozen assets and other documented values, not only money confirmed as permanently lost. The company described the number as «indicative, not exhaustive,» noting that unreported cases and unconfirmed ransom outcomes are not captured.
Most of the surge was front-loaded. Q1 2026 alone saw 35 incidents versus 22 in Q1 2025. Q2 then fell to 17 attacks, matching the Q2 2025 total. CertiK cautioned against extrapolating a full-year forecast by doubling the H1 figure, citing the uneven quarterly trend.
French authorities have intensified their response: prosecutors charged 88 suspects across 12 investigations by late April 2026. The physical threat to crypto holders is increasingly a security concern that sits alongside on-chain exploits like the $24M AFX bridge attack.
This article is for informational purposes only and does not constitute financial or investment advice.
