Are people really being attacked physically for crypto?

The full answer

Yes. Security firms call them “wrench attacks”: threats or violence used to force a holder to hand over crypto. In its August 2026 report, the blockchain analysis firm Chainalysis counted 46 violent crypto-related incidents worldwide through late June 2026, “compared to 40 at the same point in 2025.”[1] It estimates $58 million was taken in 2025, “the highest annual total on record,” and about $30 million by mid-2026, and says both figures “likely undercount the true total, as many incidents go unreported.”[1] These are company research figures built from publicly known cases. No government count of crypto-related violent crime in Canada or the US appears in the Chainalysis or TRM Labs material cited here, so none is known to exist. Chainalysis, a company, reported 46 violent crypto-related incidents documented globally through late June 2026, compared with 40 at the same point in 2025; the cited TRM Labs material describes a single sentencing case and wallet-security advice, not a count.

Is the rate of violent incidents rising year over year?

The number of attempts is rising; the amount taken is mixed. Chainalysis counts 48 violent theft attempts in 2024, 95 in 2025 and 46 by late June 2026.[1] The share of attempts that ended in payment fell, from 67% in 2024 to 49% in 2025 and 26% in 2026 so far.[1] Counting attempted extractions as well, including ransoms demanded and coerced transfers that were blocked, its totals were about $316 million in 2024, $180 million in 2025 and $107 million so far in 2026.[1] In a July 2025 report, Chainalysis said it found “a clear correlation between these violent incidents and a forward-looking moving average of bitcoin’s price,” and suggested that rising prices, or the expectation of them, “may trigger additional opportunistic physical attacks against known crypto holders.”[4]

The type of attack is shifting too. In Chainalysis’s data, home invasions made up 26% of incidents in 2023 and 37% in 2026, and kidnappings 39% and 52%.[1] The same report says home invasions jumped “from just 14% in 2025,” and elsewhere calls the kidnapping share “relatively stable,” without reconciling the figures.[1] It notes that trackers classify mixed cases differently.[1] Our reading: the trend in attack types is less certain than the headline counts.

What do documented cases look like?

In the US, TRM Labs, another blockchain analysis firm, reported that in September 2024 the leader of a home-invasion ring “that targeted crypto holders” was sentenced to 47 years in prison.[2] TRM also describes US charges in a $263 million theft case. In July 2024 one member allegedly traveled to New Mexico to break into a home “to steal a hardware virtual currency wallet,” while another is accused of tracking the victim’s location “by accessing the victim’s iCloud account.”[2] The Justice Department’s own releases on both cases came back empty when fetched on September 29, 2026, so these accounts come from TRM.

In Manhattan in May 2025, according to the Associated Press, prosecutors said two crypto investors lured a 28-year-old Italian man to a SoHo townhouse. The man said he was then held captive for 17 days. AP describes the case as the kidnapping and torture of an Italian man “for his Bitcoin.”[3] These are charges.

In Canada, TRM reports that in 2023 criminals in Richmond, B.C. “posed as police officers to enter a victim’s home, stealing approximately CAD 10 million in cryptocurrency.”[2] In France, TRM reports, Ledger co-founder David Balland and his partner were kidnapped in January 2025 and held for ransom. The attackers demanded EUR 10 million and cut off a finger.[2]

How do attackers find their targets?

Mostly by planning. Chainalysis says “most incidents we assessed were premeditated, with victims selected through exposed information, whether from data breaches, social-media activity, or insider knowledge.”[1] France shows the pattern at scale. Incidents there rose from 19 in 2025 to 30 publicly known by mid-2026.[1] Chainalysis says “a data breach is the likeliest culprit.” In 2024, it says, a French tax official is alleged to have sold dossiers that “included their names, addresses, holdings, phone numbers, and tax records.”[1] It names a January 2026 breach of about 50,000 users at the crypto tax firm Waltio as one of two factors that “may be fueling” the rise.[1] Attackers also go after family. By early 2026, Chainalysis says, about 25% to 30% of cases targeted “family members or acquaintances.”[1]

Customer lists from crypto businesses have leaked before. In a message dated December 21, 2020, Ledger’s CEO said a customer database from the company’s July 2020 data breach had been dumped online. He acknowledged that customers “expressed concerns about potential physical attacks as some of your shipping addresses were leaked,” while saying there was “no way to make any correlation between the data that has leaked and the funds on your wallet.”[5] Ways to reduce the data that links you to your holdings are on limiting personal data.

What reduces the risk?

TRM Labs says individuals should begin by maintaining privacy, “avoiding the public disclosure of their crypto holdings or any direct association between their personal identity and wallet addresses.”[2] In December 2020 Ledger advised customers not to keep a recovery sheet in a home safe, called a bank vault “much more secure,” and said that “not having immediate access to your backup increases your resilience to physical threats.”[5]

TRM also suggests multi-signature setups, which require “multiple approvals before any transaction can be executed,” and says this “makes it much harder for coercion alone to succeed.”[2] The XRP Ledger has this built in. XRPL.org says an owner can share custody so that each person “only has one of several keys necessary to send transactions,” and in one of its examples “all of the participants must agree and approve each transaction.”[6] Our reading: the trade-off is that those signers must be reachable whenever funds need to move. Whether multi-signing or delays make coercion less useful, and what each adds in complexity, is covered on XRP Ledger account security features. How much to keep in quickly reachable wallets is weighed on hot versus cold storage amounts.

What is the case against alarm?

These attacks are rare. Chainalysis itself says “violent crypto attacks remain rare events in absolute terms, and small sample sizes can produce unstable proportions.”[1] In its count, attackers also succeeded less often in 2026 than in earlier years, though it warns that small samples “can produce unstable proportions.”[1] TRM Labs (Company-reported, May 23, 2025) says multi-signature wallets, which require multiple approvals before a transaction, make it “much harder for coercion alone to succeed.” No study measuring whether multi-signing, decoy wallets or time delays make coercion less or more dangerous appears in the TRM Labs source cited here as of September 29, 2026. The suggestions follow reasoning, TRM Labs’ for multi-signing and mine for decoy wallets and time delays, not measured results. Remote attacks on accounts, which need no contact with the victim, are covered on SIM-swap theft.