Wrench attacks are escalating into violent, real‑world crypto crime

Wrench attacks — physical threats or violence used to force holders to unlock wallets or authorize transfers — are rising in frequency and severity. Newer reports cite the January 2025 kidnapping of Ledger co‑founder David Balland in France as a high‑profile example of how online crypto crime is spilling into real‑world violence. Analysts (including Haseeb Qureshi referencing Jameson Lopp’s database) find reported incidents and average severity increasing, with roughly 45% of frequency variation correlated to total crypto market capitalization. Drivers include fast, irreversible cross‑border payouts, larger reachable holdings as prices rise, easy target identification through public profiles, events and P2P/OTC activity, and data exposures (customer‑data leaks or bribed support agents) that map online identities to real addresses. Typical attack patterns move from target identification and approach to coercion and rapid fund movement; attackers sometimes target relatives when owners are unavailable. Reported geographic hotspots include parts of Western Europe and APAC, though analysts warn underreporting likely masks true prevalence. For traders, recommended mitigations include lowering public visibility, keeping day‑to‑day balances separate from long‑term stores, using multisig, time‑locks or custodial controls, treating support impersonation as a direct threat, and prioritizing physical safety over on‑chain recovery during an incident. The reports underline that cryptographic key security alone cannot remove “last‑mile” human risks and that rising market caps can increase attackers’ incentives.