CertiK's H1 2026 report reveals a 20-fold surge in crypto-related physical coercion crimes, or "wrench attacks," since H1 2025, with financial exposure increasing 11.8 times to $124.1 million. The report emphasizes the need for advanced custody solutions like multisignature wallets and distributed signers to protect against forced access.
Crypto wrench attacks, particularly home invasions, surged in the first half of 2026, with 52 verified incidents globally and a financial exposure of $124.1 million, according to CertiK. France accounted for nearly two-thirds of these physical coercion attacks, prompting authorities to launch prevention measures.
Les agressions physiques contre les détenteurs d'actifs numériques ont augmenté de 33% au premier semestre 2026, avec 52 incidents mondiaux. La France concentre 33 de ces cas, et les pertes s'élèvent à 124 millions de dollars. Les criminels ciblent les individus pour obtenir des clés privées, délaissant le piratage informatique.
The Russian ruble-backed A7A5 stablecoin has processed over $110 billion in transactions, capturing 43% of the non-US dollar market. Despite EU sanctions, its growth highlights blockchain's role in sanctions evasion, with reserves held outside Western reach.
Crypto exploit losses dropped to $68.3 million in May, a nearly 90% decrease from April's $650 million, according to CertiK. May marked the third month of 2026 with losses under $100 million, with Verus Protocol's bridge exploit being the largest incident.
Two men were arrested in France after attempting to kidnap the wife of Sébastien Borget, co-founder of The Sandbox. The attackers, disguised as delivery drivers, were apprehended by police after ordering an Uber to flee the scene. The incident is linked to a rise in crypto-related wrench attacks.
North Korea-linked hackers stole about $2.06 billion of the $3.4 billion lost in crypto hacks in 2025 and are moving from phishing to physical infiltration, CertiK’s new report finds.
New analysis reveals state-sponsored groups now dominate crypto crime, laundering billions through sophisticated cross-chain networks.
Crypto investors have lost more than $100 million to physical extortion in the first four months of 2026, according to blockchain security firm CertiK, as criminal groups increasingly target the people behind digital wallets rather than the technology securing them. The attacks, known in the industry as “wrench attacks,” use kidnapping, assault, threats, or other […] The post IRL crypto threats: Physical “wrench attacks” have led to over $100 million in losses since January alone appeared first on CryptoSlate.
Criminal teams behind wrench attacks usually consist of three to five people, often posing as delivery drivers or luring victims into ambushes, said CertiK.
AML enforcement has overtaken securities violations as the leading regulatory threat for crypto companies, with DOJ and FinCEN imposing over $1 billion in AML-related fines during H1 2025. SEC crypto-specific penalties collapsed 97% year-over-year, dropping from $4.9 billion in 2024 to $142 million in 2025. Major settlements include OKX ($504M) and KuCoin ($297M) for BSA violations. The shift reflects US administration policy changes and broader global regulatory trends, including 767% surge in European AML fines and 400% growth in sanctions-related crypto volume.
CertiK has urged crypto users not to overlook basic security practices as major crypto hacks spiked in April.
CertiK senior blockchain investigator Natalie Newson warns that real-time deepfakes, phishing attacks, supply chain compromises and cross-chain vulnerabilities will drive the biggest crypto hacks in 2026. The industry has already lost over $600 million in 2026, dominated by two North Korea-linked exploits in April: the $293 million Kelp DAO hack involving LayerZero's cross-chain protocol, and the $280 million Drift Protocol exploit. North Korean hackers also used AI for social engineering in a $100,000 Zerion wallet breach. Newson advises investors to use cold wallets and verify URLs. Regulators are responding, with the US Treasury expanding its cybersecurity threat identification to cover digital asset companies.
