Cryptocurrency theft is increasingly moving beyond the screen. Criminals are using violence, threats, home invasions, and kidnapping attempts to force victims to unlock wallets or approve transfers while under pressure.
These incidents are known as wrench attacks, a term that describes bypassing strong encryption by targeting the person who controls the keys.
Instead of defeating a wallet’s security, attackers attempt to coerce its owner into giving up access. Analysts at TRM identified a growing pattern of physical attacks against people linked to digital asset wealth, including investors, traders, company leaders, and their relatives.
The trend shows how public exposure of crypto holdings can become a real-world safety risk.
The attacks have been reported across France, the United States, the United Kingdom, and Canada.
They blur the line between cybercrime and conventional violent crime, while forcing victims and security teams to rethink how wallet access is protected.
TRM said in a report shared with Cyber Security News (CSN) that criminals see cryptocurrency as an attractive target because transfers can be rapid and difficult for victims to reverse.
Wrench Attacks Bypass Encryption
A wrench attack does not depend on malware, phishing, or a software flaw. The attacker uses intimidation or physical force to make the victim reveal a password, unlock a device, hand over a hardware wallet, or authorize a transaction.
The name comes from a well-known idea in security discussions: even the best encryption can fail to protect assets if a criminal can physically threaten the person holding the secret.
That risk is very different from the threats covered in reports about crypto wallet seed phrase theft, where malicious software is used to capture recovery information.
France has become a prominent example of the danger. In May 2025, masked attackers reportedly tried to abduct the daughter and grandson of a cryptocurrency chief executive in Paris, but the attempt was disrupted after relatives and bystanders intervened.
Earlier that month, the father of a crypto entrepreneur was abducted in Paris, with the perpetrators demanding a ransom reportedly between EUR 5 million and EUR 7 million.
The victim was later rescued after 58 hours, and police arrested five suspects. The report also cited the January 2025 kidnapping of Ledger co-founder David Balland and his partner from their home in central France.
Attackers demanded EUR 10 million and allegedly injured Balland to pressure compliance before both victims were rescued. Similar cases have appeared elsewhere.
In the United States, prosecutors alleged that members of a criminal operation tracked people believed to own large crypto balances, including a July 2024 burglary involving the theft of a hardware wallet from a New Mexico home.
Criminals may combine online surveillance with physical targeting. Social media posts, public wallet discussions, travel habits, family details, and visible displays of wealth can all help attackers build a profile before approaching a potential victim.
This differs sharply from a typical online wallet compromise, such as fake crypto wallet applications designed to drain funds without face-to-face contact. In wrench attacks, the victim’s personal safety becomes the immediate point of failure.
Reducing Personal Exposure
TRM said a common thread in many cases is the profiling of victims before an offence takes place.
People who openly discuss holdings, post wallet-related activity, or connect their identity with substantial assets may face a higher risk of being singled out.
The first practical step is discretion. Crypto holders should avoid publicly linking wallet addresses to their identity and should be careful about sharing investment success, travel plans, home details, or family information on social platforms.
That advice complements broader precautions against cryptocurrency exchange phishing attacks, where criminals attempt to steal credentials or recovery phrases remotely.
Physical and digital security should be treated as connected layers, not separate problems. For significant holdings, multi-signature wallets can reduce the chance that one coerced person can immediately transfer assets.
Requiring more than one approval creates an additional barrier, although it does not remove the need for careful personal security planning.
The report also recommends stronger physical safeguards based on the threat level. Home security systems, secure transport arrangements, protected storage, and professional security support may be appropriate for people with a high public profile or substantial assets.
Family members should understand the warning signs as well. Criminals may target relatives as leverage, so households should discuss suspicious activity, avoid confronting possible surveillance, document concerns, and promptly notify local authorities when threats emerge.
Law enforcement can still trace stolen funds in many cases by following transactions across blockchains and identifying points where assets may be exchanged or cashed out.
However, recovery efforts do not lessen the immediate harm caused by coercion and violence. The rise of wrench attacks is a reminder that encryption protects data and wallet keys, but it cannot protect a person standing in front of an attacker.
Limiting public exposure and preparing for physical threats are now essential parts of crypto security.
