The Uncomfortable Consequence of Self-Custody
This site tells you to hold your own keys. To buy a hardware wallet, write your seed phrase on paper, store it at home, and stop trusting exchanges with your money.
That advice is correct. It also creates a risk we haven’t addressed, and 2026 made ignoring it indefensible.
CertiK verified 52 physical attacks against cryptocurrency holders worldwide in the first half of 2026, up 33% year on year, with financial exposure of $124.1 million. Europe accounted for 39 of those 52 incidents. Chainalysis, measuring differently, put direct losses above $30 million for the same period — on pace to exceed 2025’s record of $58 million.
The industry calls these wrench attacks, after an old security joke: all your encryption is worthless against someone willing to hit you with a wrench until you hand over the password. The joke stopped being funny somewhere around 2025.
CertiK summarised the shift in four words: crypto crime has gone physical.
This article covers what the data actually shows, why European holders are disproportionately affected, and the specific, practical defences that exist — including some that most people have never heard of.
What the Numbers Show
The scale
- 52 verified physical attacks globally in H1 2026, up from 39 in H1 2025 — a 33% increase
- $124.1 million in financial exposure (CertiK); $30 million+ in confirmed direct losses (Chainalysis)
- 72 verified cases across all of 2025, roughly 75% higher than 2024, with $41 million in losses
- Chainalysis documented 46 attempts in H1 2026, of which 12 resulted in payment
That last figure matters and cuts both ways. A roughly 26% success rate means most attacks fail — but it also means criminals are willing to run an operation with a 74% failure rate, which tells you how profitable the successes are.
The shift from kidnapping to home invasion
This is the defining tactical change of 2026, and it’s the one with direct implications for how you live.
Home invasions rose from one publicly reported incident in H1 2025 to twenty in H1 2026. Kidnappings rose more modestly, from 12 to 16.
The logic is straightforward from the attacker’s side. Kidnappings are difficult to execute — they require holding a person, managing a negotiation, and sustaining an operation over time. A home invasion requires knowing an address.
Why amounts don’t protect you
A common and dangerous assumption is that this only affects people with large holdings.
CertiK’s analysis includes kidnappings over as little as $6,000 worth of crypto, and people murdered over $50,000.
Whatever threshold you have in your head below which you think you’re not worth attacking, it is probably wrong.
Europe, and France specifically
France has become the epicentre. CertiK counted 33 attacks there in H1 2026 — nearly two thirds of all publicly reported cases. Chainalysis recorded 30 incidents through mid-2026, more than any other country. French Interior Minister Laurent Nuñez put the first-half count of kidnappings, extortions and attempted extortions at 77, against 45 in all of 2025.
The response has been substantial. By April 2026, French authorities had charged 88 suspects across 12 investigations, including more than ten minors. The government introduced a rapid-alert and protection system, promised greater intelligence-sharing with the crypto industry, and offered home security assessments for executives. In February 2026, six people including one minor were arrested after a magistrate and her mother were abducted in an attempted crypto-ransom operation.
For comparison, the country with the second-most verifiable attacks in CertiK’s H1 2026 data was the United States, with four.
If you are a self-custody holder in continental Europe, you are in the highest-risk geography in the world for this specific threat.
Why France? The Data Answer
The concentration isn’t cultural. It’s informational.
Chainalysis linked the French surge to an alleged breach involving tax records that exposed information about high-net-worth crypto holders. Separately, a French tax official allegedly accessed and sold information about crypto investors to criminals, and a breach at crypto tax-reporting company Waltio reportedly exposed data belonging to around 50,000 users.
CertiK’s analysis identifies the mechanism precisely: the important thing is that criminals can now link crypto holders with personal information like home addresses.
That single sentence is the whole threat model. A wrench attack requires two pieces of information — that you hold crypto, and where you sleep. Neither is secret any more. KYC databases, tax records, exchange breaches, and your own social media all supply the first. Data brokers, leaked databases, and public records supply the second.
The attack doesn’t begin with violence. It begins with a spreadsheet. Related: Your Data Is the Attack Surface: How Breaches, KYC and Tax Records Make You a Target
Your Family Is Inside the Perimeter
One of the more disturbing findings is that attackers have widened their targeting.
Security analysis of 2026 cases notes that attacks increasingly place victims’ relatives, personal information, routines and homes within the perimeter criminals seek to penetrate. Proxy victims — partners, children, parents — often have weaker operational security, more predictable routines, and no training at all.
The February 2026 French case involved abducting a magistrate and her mother in a crypto-ransom operation. CertiK’s 2026 reporting notes incidents where relatives of holders were targeted specifically because they were easier to reach.
This has a direct consequence: your personal security practices are insufficient if the people around you don’t share them. A partner who posts holiday photos with location data, or a child who mentions a parent’s crypto work online, is a vector you can’t close by improving your own habits.
What Actually Works
The defences fall into three categories. Only the third is specific to crypto, and it’s the one almost nobody has implemented.
Category 1: Don’t become a target
Never discuss holdings. Not amounts, not gains, not specific assets. Not on X, not in a Telegram group, not at a dinner party. Security experts consistently advise holders not to openly discuss their wealth or holdings, and it remains the highest-leverage single behaviour available.
This is harder than it sounds, because crypto culture is built around public discussion of positions. Portfolio screenshots, “wen lambo,” gain posts, and public wallet addresses linked to a named identity are all normal community behaviour and all of them are targeting data.
Separate your public identity from your on-chain identity. A wallet address publicly associated with your real name is a published balance sheet. Use different addresses for public-facing activity than for holdings.
Audit what’s already out there. Search your own name alongside crypto terms. Check whether your email appears in known breaches. Check whether your address is retrievable from public records or data brokers in your jurisdiction. You cannot retract leaked data, but you can know what an attacker would find.
Keep sensitive accounts off devices used while travelling. A phone with wallet apps, in a country where you’re visibly a tourist, is both a target and a map.
Category 2: Physical and household measures
These are ordinary home security measures, applied for a specific reason.
Harden entry points. Install cameras covering approaches, not just the door. Vary routines where practical — predictability is an operational requirement for an attacker.
Prepare an emergency plan with family members. This is the item people skip because it feels melodramatic. It isn’t. Everyone in the household should know: don’t resist, don’t negotiate, comply with demands for property, and understand that no amount of crypto is worth injury. Decide this in advance, calmly, rather than under duress.
Don’t keep hardware wallets, seed backups and the holdings they control in one obvious place in one obvious house.
Category 3: Make coercion unprofitable
This is the genuinely crypto-specific layer, and it’s the most important part of this article.
CertiK’s recommendation after analysing 2026’s cases is specific: build security structures that prevent any one threatened person from releasing an entire balance.
If an attacker can obtain everything by coercing one person at one location, you have designed your custody to be maximally vulnerable to exactly this attack. The countermeasures:
Passphrase-protected hidden wallets. Most hardware wallets support an optional passphrase on top of the seed phrase. A different passphrase derives a completely different wallet. This means your seed phrase can be surrendered — revealing a wallet with a modest, plausible balance — while the passphrase-protected wallet holding the bulk remains invisible. The seed alone shows nothing of its existence. Related: Seed Phrase Security Guide 2026 | How to Back Up & Protect Recovery Keys
This is plausible-deniability custody, and it is the single most effective defence against coercion that exists today.
Multi-share backup with geographic separation. Shamir-style multi-share backup splits your seed into shares, a threshold of which is needed to reconstruct the wallet. If three of five shares are required and they sit in three different locations, no single home invasion recovers the wallet. The attacker can take everything in the house and still have nothing.
Multisignature wallets. A 2-of-3 multisig requires two keys to move funds. If one key is held elsewhere — a different location, a different person, a co-signing service — then coercing you at home is insufficient. It’s more operationally complex than a single hardware wallet and worth it above a certain threshold.
Duress and panic wallets. An emerging category discussed as a response to this threat: wallets that can call for help, wipe balances, or present a decoy when the holder is under duress. The concept is sound; implementations vary in maturity, and anything in this category should be tested thoroughly before you rely on it.
Split your balance by accessibility. A modest amount in a wallet you can genuinely access under pressure gives an attacker something to take and gives you something to surrender. The alternative — being unable to produce anything — is a far worse position to be in during a violent encounter.
The Honest Trade-off
There’s a tension in all of this that deserves stating plainly rather than being glossed over.
Everything in Category 3 makes your crypto harder for an attacker to take. It also makes it harder for you to access, and considerably harder for your family to recover if something happens to you. Multi-share backup across three locations is excellent against coercion and a serious obstacle to inheritance. A passphrase nobody else knows is perfect security and permanent loss if you die without documenting it.
These are the same trade-off viewed from opposite ends, and you can’t optimise for both without deliberate planning. Related: What Happens to Your Crypto When You Die
The resolution isn’t to pick one. It’s to design custody that handles both cases explicitly — which means writing down what happens in each scenario and testing it, rather than assuming it will work out.
If It Happens
Three things, decided now rather than then.
Comply. Property is replaceable. CertiK’s own framing is that these attacks bypass even the most sophisticated digital security — the time to have solved this was before, through structure. During the event, resistance achieves nothing except injury.
Report it. Underreporting is severe — security firms consistently note their counts undercount because many victims never report, and some cases only become public after investigations conclude. Reporting improves the data, supports investigation, and in France has supported an active prosecution effort that charged 88 suspects in a single quarter.
Move everything afterwards. Any key material the attacker saw, touched, or might have photographed is compromised. Rebuild on new hardware with a new seed.
The Bottom Line
The security advice this site gives you — self-custody, hardware wallets, hold your own keys — remains correct. But the complete version of that advice includes the risk it creates.
Three things, in order of leverage:
- Stop generating targeting data. Don’t discuss holdings, separate public identity from on-chain identity, and extend this to your household.
- Structure custody so no single coerced person can release everything. Passphrase-protected hidden wallets, multi-share backup across locations, or multisig.
- Plan the human side in advance. Family agreement to comply, a decoy balance you can produce, and a decision made calmly rather than at 3am.
The trend is clear and it isn’t reversing. 2025 was a record year, 2026 is on pace to beat it, and the data breaches feeding it keep happening. Treating physical security as a crypto security problem is no longer paranoid. In Europe, it’s overdue.
Transparency: TrueToCrypto may earn affiliate commissions from links in articles. Recommendations are based on security merit, not commission rates. This article is educational and is not personal security advice. If you believe you are at specific risk, consult qualified security professionals and your local police.
Contact: info@truetocrypto.com
Figures drawn from CertiK’s Intel3D H1 2026 Wrench Attacks Report (July 2026), Chainalysis reporting (August 2026), and French government statements. Verified October 2026.
