Physical crypto thefts surge tenfold to $124m, CertiK says
A tenfold surge in physical crypto thefts to $124 million highlights a growing blind spot in wealth protection for digital asset holders.
Physical assaults targeting cryptocurrency holders resulted in $124 million of stolen funds and ransom demands in the first half of 2026, a more than tenfold increase from the previous year. According to a report published Wednesday by blockchain security firm CertiK, criminals carried out 52 such "wrench attacks" between January and June, exploiting a vulnerability that no digital firewall can patch: the physical location of the key holder.
The sheer scale of the financial exposure, up from $10.5 million in the first half of 2025, signals a maturation of a once-niche criminal tactic into a systemic risk for the industry. For institutional investors and wealth managers advising high-net-worth clients on digital asset allocations, the data underscores that cybersecurity measures alone are insufficient. Hardware wallets and multi-factor authentication offer no protection when victims are physically coerced.
Geographic and Tactical Shifts
The threat is highly concentrated in Western Europe. "Geographically, the threat landscape became highly concentrated. Europe accounted for 39 of 52 verified H1 2026 incidents. France alone accounted for 33 incidents, making it the dominant national epicenter in the dataset," CertiK said. This geographic clustering suggests organized criminal networks are operating with local intelligence on wealthy targets rather than conducting opportunistic attacks.
Criminals are also changing their methods. While overall incident frequency slowed in the second quarter, the violence has escalated. "Tactically, the defining shift of H1 2026 is the rise of home invasion tied to crypto. Home invasions increased from one publicly reported incident in H1 2025 to 20 in H1 2026," the firm noted. Kidnappings have also increased, indicating a willingness to use prolonged detention to extract digital keys.
Operational Security
For executives and professional investors holding significant digital assets, the report necessitates a fundamental review of personal operational security. CertiK advises clients to sever any public links between their real-world identities, daily routines, and crypto holdings.
Furthermore, access rights must be decentralized to mitigate the impact of a single point of failure. Significant assets should be structured so that no single person can immediately transfer funds, requiring wallets, signing devices, and recovery materials to be kept in separate, secure locations. The firm also recommends keeping sensitive accounts off devices used during travel and establishing clear emergency plans with households.
