Data provided by the French Ministry of the Interior to Cointelegraph shows that from January 1 to mid-August 2026, France recorded 90 offline attacks targeting cryptocurrency holders. During the same period, French authorities also recorded 223 arrests, and a total of 126 people were imprisoned from January to July.
These figures equate to one new case occurring every two and a half days on average. However, there are currently no official year-on-year data available for comparison, so it is not possible to determine whether the situation has suddenly worsened. The Ministry of the Interior stated: "We do not have statistical data for these items for 2025, as the incident records only began on January 1, 2026."
What makes the new data more notable is that it far exceeds other publicly available statistics that track "physical attacks."
According to statistics from Chainalysis, as of mid-2026, there were 30 reported cases of violent crypto-related incidents in France, but it is also noted that the actual scale is "likely to be much larger." Security company Gart.io has tracked a total of 73 attacks in France to date, placing France at the top, surpassing the 66 attacks in the real world in the United States and the 27 in the United Kingdom.
France has seen an increase in offline attacks targeting cryptocurrency holders, also known as "wrench attacks," indicating that the issue may be more than just a surge in sporadic incidents. The leaked personal data could be the main culprit.
Why France?
"Wrench attacks" are not a new phenomenon. A known catalog of offline attacks, which has been maintained for a long time by Bitcoin security advocate Jameson Lopp, shows that between 2014 and 2026, there were 365 incidents recorded in 60 countries, with France topping the list.
However, the new development seems to lie in the speed at which violent encryption crimes are spreading in France. Chainalysis points out that these attacks are no longer limited to Paris; they have also spread to Strasbourg, Marseille, Grenoble, Toulouse, Nantes, and other places.
Chainalysis, the research supervisor, told Cointelegraph that this surge is "very likely" related to "a major data breach."
"What's exposed in these leaks is not just financial information; they also reveal who holds crypto assets, where they live, and how to find them."
This makes offline attacks against cryptocurrency holders particularly insidious, as attackers often begin their preparations long before they demand that victims hand over their mnemonic phrases or transfer funds using wrenches. First and foremost, the assailants need to know who has something worth stealing, where they live, and how to approach them.
Jardine says that a leak by the French tax authorities in 2024 may have played a catalytic role. At that time, a tax official from the Paris region "leaked personal identity information, financial information, and encrypted holdings of French taxpayers." Records from Chainalysis show that attacks surged after the end of November of the same year.
Chainalysis also pointed out that in January 2026, another incident occurred: the crypto tax filing company Waltio was compromised, affecting approximately 50,000 users, providing attackers with even more useful data for targeting.
The founder of the Canadian Bitcoin exchange Bull Bitcoin, Francis Pouliot, has repeatedly questioned Europe's DAC8 crypto reporting regulations in France. These regulations have expanded the tax reporting and information sharing requirements for crypto users within the EU.
He stated, " DAC8 has turned 'knowing your customers' into 'killing your customers.'" He also referred to France as "the capital of crypto kidnapping in the world."
When the target is not the Bitcoin holder themselves
According to Chainalysis, one of the most notable changes may be the shift in the identity of the victims. By the beginning of 2026, globally, relatives and acquaintances accounted for about 25% to 30% of violent crypto incidents; in France, this proportion exceeds 40%.
In May 2026, six men allegedly attempted to abduct the wife of The Sandbox, co-founder of bastien and Borget, from a residence in Villeneuve, France. One of the attackers disguised himself as a delivery man in an attempt to get her to open the door.
In August, a couple in a French village reportedly experienced three attempts to break into their home. Previously, the property they purchased was inhabited by an encrypted millionaire, and the tax information and address of the previous homeowner were leaked to the dark web.
A similar tactic occurred in 2025 as well: The father of an encryption entrepreneur was kidnapped in Paris and held captive for two days. The kidnappers allegedly cut off a part of his finger and sent it to his son, demanding 5.6 million US dollars in cryptocurrency in exchange.
This subverts people's usual understanding of the targets of encryption, because the person holding the wallet is not necessarily the same as the person standing in front of the attacker.
French authorities are treating these attacks as organized crime and coordinating the investigations through the country's specialized agency for organized crime, JUNALCO.
$5 Wrench Puzzle
Most cryptocurrency holders have learned how to protect their mnemonics, set up hardware wallets, test environments, and avoid clicking on phishing links.
These practices are still important, but if the bad guys already know who you are, where you live, and that you have something worth stealing, then these measures are of no use at all.
Cryptography can protect wallets, but it cannot stop an attacker armed with a $5 wrench.
