CertiK says crypto wrench attacks hit 52 in H1 as exposure reaches $124.1 million

Attack count rises, exposure jumps

CertiK said the first-half total was up 33.3% from 39 verified incidents in H1 2025. The increase in financial exposure was far steeper. A year earlier, the comparable figure was about $10.5 million, meaning the latest total represents a 1,079% jump by CertiK’s calculation.

The firm also said average exposure per incident climbed sharply, from roughly $270,000 last year to $2.39 million in H1 2026. It stressed that the $124.1 million figure is not limited to money confirmed as permanently lost. Instead, it includes stolen funds, ransom demands, frozen assets and other values tied to documented cases.

CertiK described those numbers as indicative rather than exhaustive. Some victims never report attacks, and public records do not always show whether demanded or stolen funds were paid, recovered or frozen. For that reason, the company presents the total as recorded exposure, not confirmed criminal proceeds.

Europe dominates the dataset

Europe accounted for 39 of the 52 verified attacks, or 75% of the global total in CertiK’s dataset. France alone represented 33 incidents, equal to 63.5% of all verified cases worldwide and 84.6% of the European total.

Outside France, the United States recorded four verified incidents, while Sweden and the United Kingdom recorded two each. CertiK noted, however, that the French count in its public dataset may understate the true number. The report cited France’s National Directorate of Judicial Police as having recorded 41 incidents between January and March alone. According to CertiK, some events may be categorized under robbery, kidnapping, assault or extortion without being clearly labeled as crypto-related.

Q1 drove most of the increase

The rise in attack frequency was concentrated in the first quarter. CertiK recorded 35 incidents in Q1 2026, compared with 22 in the same period of 2025. Activity then slowed in the second quarter, with 17 verified attacks, matching the Q2 2025 count.

That pattern suggests the first-quarter spike was responsible for most of the year-on-year increase in the first-half totals, even though the financial value associated with known cases remained well above last year’s level overall.

Home invasions become the main method

Among attack types, home invasions saw the biggest shift. CertiK recorded 20 home invasion cases in H1 2026, compared with just one in the same period a year earlier. That made home invasions the most common category, accounting for about 41% of first-half attacks.

Kidnappings also increased, rising from 12 to 16 cases. Torture cases were unchanged at four, while murder remained at one verified incident.

CertiK defines wrench attacks as incidents in which physical force, threats or intimidation are used to compel a victim to transfer crypto, reveal private keys or unlock wallets. The firm said this approach can sidestep technical protections by targeting the person controlling the assets rather than the software securing them.

Security costs and defensive advice

The rise in offline threats has pushed some crypto firms to increase spending on personal protection for executives. CertiK pointed to several examples disclosed by public companies. Coinbase spent about $8.7 million on security and protection costs linked to CEO Brian Armstrong in 2025. Gemini agreed to pay $400,000 per month for executive protection services. MARA also disclosed $4.3 million in security spending tied to CEO Fred Thiel, including $430,000 for vehicle armoring.

CertiK said holders should reduce publicly available links between their identity, location, routines and crypto ownership. It also recommended separating signing devices from recovery materials, using multi-party controls for larger holdings and avoiding arrangements in which a single person can move all assets immediately under pressure.