Skip to navigation

Threat reportThreat IntelligenceTL-2026-1737

Wrench Attacks: Physical Coercion Bypasses Cryptocurrency Wallet Encryption Amid 33% YoY Surge in H1 2026

highACTIVE

Blockchain-security firms TRM Labs and CertiK document a sharply escalating global pattern of 'wrench attacks' — kidnapping, home invasion, torture, and extortion used to physically coerce cryptocurrency holders (and their families/employees) into surrendering keys or approving transfers. CertiK's Intel3D H1 2026 report verified 52 incidents worth $124.1M in exposure (up 33% YoY, ~12x the dollar losses of H1 2025), concentrated in France, the UK, the US, and Canada, with Europe accounting for 79.6% of cases.

Key facts for Crypto wrench attacks 2026

IdentifiersTL-2026-1737
Also known as$5 Wrench Attack, Rubber-Hose Cryptanalysis, Wrench Cryptanalysis, Crypto Kidnapping
SeverityHIGH
Exploitation statusExploited in the wild
Affected productsN/A (individuals, not a software vendor) Self-custodied cryptocurrency wallet holders (investors, traders, executives, founders, influencers) and their families/staff
MITRE ATT&CK techniquesT1078 Valid Accounts, T1111 Multi-Factor Authentication Interception, T1199 Trusted Relationship, T1430 Location Tracking, T1451 SIM Card Swap, T1586 Compromise Accounts, T1589 Gather Victim Identity Information, T1591 Gather Victim Org Information, T1593 Search Open Websites/Domains, T1596 Search Open Technical Databases, T1657 Financial Theft, T1684.001 Impersonation
MotivationFINANCIAL
Target sectorsfinance, cryptocurrency, technology
Target regionsEurope, North America, france, united kingdom, united states of america, canada
Detection rules9 (1 shown free)
Sources13 cited sources

Detection coverage for Crypto wrench attacks 2026

As of 2026-07-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1737 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Compromised-Account Location-Polling Spike Correlated with OSINT Recon and High-Value Transfer

Detects a cloud-identity session-token reissuance on an unrecognized device followed by an anomalous spike (>4 polls within 30 minutes) in device-location/Find-My-style API calls — the pattern from the Malone Lam RICO case where a compromised iCloud account was abused to remotely track a victim's real-time location ahead of an armed robbery — optionally correlated with prior OSINT-style wealth-signal/proxy-victim recon and a subsequent high-value cryptocurrency transfer approval, representing the full surveillance-to-financial-theft chain that enables physical wrench-attack coercion.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1586, T1430, T1657, T1593, T1596, T1591, T1589
  • Data sources: cloud_identity_account_activity, cloud_location_api_logs, crypto_custodian_transfer_approval_log, web_proxy_logs
  • Severity: critical
  • Confidence: high

Splunk SPL

index=cloud_identity sourcetype="cloud:identity:accountactivity" event_type="session_token_reissue" device_trust="unrecognized"
| eval reissue_time=_time, account=user
| fields account, reissue_time
| join type=inner account
    [ search index=cloud_identity sourcetype="cloud:identity:location_api" (api="find_my" OR api="device_location")
      | eval poll_time=_time
      | stats count as poll_count, min(poll_time) as first_poll, max(poll_time) as last_poll by account ]
| where poll_count>4 AND (first_poll-reissue_time)<=1800
| join type=left account
    [ search index=crypto_custody sourcetype="custodian:transfer_approval" amount_usd>100000
      | eval transfer_time=_time
      | fields account, transfer_time, amount_usd, destination_wallet ]
| table account, reissue_time, poll_count, first_poll, last_poll, transfer_time, amount_usd, destination_wallet
| sort - last_poll

Microsoft KQL

let SuspiciousSessions = CloudAppEvents
    | where TimeGenerated > ago(24h)
    | where ActionType in ("TokenReissued", "LogonUser")
    | where DeviceTrustType == "Unmanaged"
    | project ReissueTime = TimeGenerated, AccountId, DeviceTrustType;
let LocationPolls = CloudAppEvents
    | where TimeGenerated > ago(24h)
    | where ActionType in ("FindMyDeviceQuery", "DeviceLocationQuery")
    | summarize PollCount = count(), FirstPoll = min(TimeGenerated), LastPoll = max(TimeGenerated) by AccountId;
let Transfers = CryptoTransferApprovals_CL
    | where TimeGenerated > ago(24h)
    | where AmountUsd_d > 100000
    | project TransferTime = TimeGenerated, AccountId = AccountId_s, AmountUsd_d, DestinationWallet_s;
SuspiciousSessions
| join kind=inner LocationPolls on AccountId
| where (FirstPoll - ReissueTime) between (0min .. 30min) and PollCount > 4
| join kind=leftouter Transfers on AccountId
| project AccountId, ReissueTime, PollCount, FirstPoll, LastPoll, TransferTime, AmountUsd_d, DestinationWallet_s

Sigma

title: Compromised-Account Location-Polling Spike Correlated with OSINT Wealth-Signal Recon and High-Value Transfer
id: 8f2a1c40-9e3b-4c7d-9f21-1737aa000003
status: experimental
description: Detects a session-token reissuance on an unrecognized device followed by an anomalous spike in device-location/Find-My-style API polling, optionally correlated with prior OSINT-style reconnaissance (social-media wealth-signal profiling, public wallet-disclosure lookups, proxy-victim identification) and a subsequent high-value cryptocurrency transfer approval — the compromised-account surveillance pattern used to physically locate and coerce wrench-attack victims (Malone Lam RICO case pattern).
references:
    - https://www.justice.gov/usao-dc/pr/additional-12-defendants-charged-rico-conspiracy-over-263-million-cryptocurrency-thefts
    - https://www.trmlabs.com/resources/blog/the-rise-of-wrench-attacks-and-crypto-related-violent-crime
    - https://github.com/jlopp/physical-bitcoin-attacks
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-28
tags:
    - attack.collection
    - attack.resource-development
    - attack.reconnaissance
    - attack.impact
    - attack.t1586
    - attack.t1430
    - attack.t1657
    - attack.t1593
    - attack.t1596
    - attack.t1591
    - attack.t1589
logsource:
    category: application
    product: cloud_account_activity
detection:
    selection_reissue:
        EventType: 'session_token_reissue'
        DeviceTrust: 'unrecognized'
    selection_location_poll:
        Api:
            - 'find_my'
            - 'device_location'
    selection_osint_recon:
        DestinationHost|contains:
            - 'wallet-explorer'
            - 'instagram.com'
            - 'tiktok.com'
        QueryString|contains:
            - 'net worth'
            - 'portfolio'
            - 'hodl'
    selection_high_value_transfer:
        AmountUsd: '>100000'
    timeframe: 24h
    condition: (selection_reissue and selection_location_poll) or (selection_osint_recon and selection_high_value_transfer)
falsepositives:
    - Legitimate device replacement with Find My re-enabled by the account owner shortly after
    - Corporate OSINT/brand-protection team's own authorized monitoring queries (should be allowlisted by source account)
level: high

Known false positives:

  • Legitimate device replacement with Find My/location services re-enabled by the account owner shortly after migration
  • Corporate OSINT/brand-protection or executive-protection team's own authorized monitoring queries against the same wealth-signal/wallet-explorer sources

Tuning notes: Requires personal/executive cloud-account activity telemetry (via consented VIP-protection monitoring or MDM integration), a custodian/exchange transfer-approval audit feed, and web-proxy visibility into OSINT/wallet-explorer lookups; allowlist the security team's own authorized monitoring source accounts and tune the $100k transfer threshold to the protected population's typical holdings.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • SIM Port-Out Alert Followed by MFA Method Change on Monitored High-Value Identity · unlock with TL Creds
  • Helpdesk Impersonation Bypasses Knowledge-Based Auth Preceding Account Recovery · unlock with TL Creds
  • Compromised-Account Location-Polling Spike Correlated with OSINT Recon and High-Value Transfer · unlock with TL Creds
  • SIM Port-Out Alert Followed by MFA Method Change on Monitored High-Value Identity · unlock with TL Creds
  • Helpdesk Impersonation Bypasses Knowledge-Based Auth Preceding Account Recovery · unlock with TL Creds
  • Compromised-Account Location-Polling Spike Correlated with OSINT Recon and High-Value Transfer · unlock with TL Creds
  • SIM Port-Out Alert Followed by MFA Method Change on Monitored High-Value Identity · unlock with TL Creds
  • Helpdesk Impersonation Bypasses Knowledge-Based Auth Preceding Account Recovery · unlock with TL Creds

Indicators of compromise for Crypto wrench attacks 2026

As of 2026-07-28, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-1737.

21 indicators of compromise · unlock with TL Creds. Compare plans

How Crypto wrench attacks 2026 works

"Wrench attacks" — named for the xkcd "$5 wrench" rubber-hose-cryptanalysis joke — describe a non-technical attack vector in which adversaries bypass wallet encryption entirely by targeting the human holding the key rather than the cryptography itself. Victims are coerced through home invasion, kidnapping-for-ransom, armed/knifepoint robbery, torture, or credible threats of violence against themselves or family members until they unlock a wallet, disclose a seed phrase, or approve an on-chain transfer under duress.

The pattern has escalated sharply through 2025-2026. TRM Labs recorded roughly 55 wrench attacks globally in 2025 (the worst year on record at the time), while independent tracker Jameson Lopp's 'physical-bitcoin-attacks' GitHub list logged over 70 incidents in the same period and now exceeds 200 entries since 2014, with a 169% increase in reported attacks in the first six months of 2025 alone. CertiK's Intel3D H1 2026 Wrench Attacks Report — the most current authoritative dataset — verified 52 distinct global incidents in H1 2026, a 33% year-over-year increase from 39 in H1 2025, with total recorded financial exposure jumping to $124.1 million (versus $10.5M in H1 2025), an almost 12-fold increase. Average exposure per incident rose from roughly $270,000 to $2.39 million. Home invasion overtook kidnapping as the most common method (20 vs. 1 incident YoY), kidnappings rose from 12 to 16, and the report recorded 4 torture incidents and 1 murder. Europe accounted for 79.6% of verified H1 2026 incidents, with France alone responsible for 33 incidents (63.5% of the global total).

Named incidents anchor the pattern: Ledger co-founder David Balland and his partner were kidnapped from their central-France home in January 2025 (€10M ransom demand, finger severed, rescued after ~24 hours); in May 2025 the daughter and grandson of a Paris crypto executive narrowly escaped an abduction attempt, and separately the father of a crypto entrepreneur was kidnapped and held 58 hours under a €5-7M ransom demand (finger severed, five suspects arrested); in a Vancouver, Canada home invasion (court records unsealed November 2025) victims were waterboarded and a family member sexually assaulted while $1.5M in Bitcoin was stolen; in March 2026 a UK-based crypto figure ('Sillytuna') was held down by four assailants under threats of weapons and rape and forced to transfer roughly $24M in stablecoin; and in April 2026 a mother and child were kidnapped in France. In the US, DOJ prosecutors used RICO organized-crime statutes against a 13-defendant conspiracy (fronted by Malone Lam) that stole over $230-263M in cryptocurrency via SIM-swapping and home invasions, in one case remotely tracking a Washington DC victim's real-time physical location through a compromised iCloud account to coordinate an armed robbery on August 18, 2024. A related, earlier home-invasion crew led by Remy Ra St Felix combined SIM-swapping with gunpoint robbery to steal $3.5M+; St Felix was sentenced to 47 years, later extended by 6 years 10 months for assaulting a trial witness. UK cases date back to 2018 (Danny Aston, Oxfordshire, gunpoint Bitcoin transfer) and include a 2021 knifepoint robbery of a university student and a 2021-2022 London teen-gang spree that stole £115,000 via crypto-app muggings.

TRM Labs researchers (Ari Redbord, Phil Ariss) attribute the rise to three converging factors: cryptocurrency's mainstream adoption expanding the pool of visible, reachable targets; the perceived irreversibility/pseudonymity of on-chain transfers making crypto holders attractive relative to traditional banking targets; and criminals' increasing use of social media (Instagram, TikTok, podcast appearances) for OSINT-driven wealth-signal profiling and victim identification. Attackers increasingly target proxy victims — a holder's spouse, parent, child, employee, driver, or assistant — who often have weaker personal security and more predictable routines than the primary target. Analysts also note 'violence-as-a-service' overlap between established cybercrime networks (loosely termed 'The Com'/'IRL Com', overlapping with Scattered Spider/UNC3944-adjacent actors) and organized crime groups willing to conduct in-person robbery and extortion. Law enforcement response includes blockchain-forensics tracing (Coinbase cooperation enabled UK convictions), DOJ RICO prosecutions, and law-enforcement training initiatives (e.g., a December 2025 CryptoUK webinar), but police in most jurisdictions are widely assessed as under-resourced and under-trained for this crime pattern, and incidents are believed to be significantly underreported.

This threat has no CVE, no exploit code, and no traditional network/malware IOCs — it is documented here as a physical/OSINT threat vector materially relevant to high-net-worth and publicly identifiable cryptocurrency holders, their families, and their staff.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1199 Trusted Relationship

Persistence

T1078 Valid Accounts

Privilege Escalation

T1078 Valid Accounts

Defense Evasion

T1078 Valid Accounts

Credential Access

T1111 Multi-Factor Authentication Interception

Collection

T1430 Location Tracking

initial-access

T1451 SIM Card Swap

Resource Development

T1586 Compromise Accounts

Reconnaissance

T1589 Gather Victim Identity Information; T1591 Gather Victim Org Information; T1593 Search Open Websites/Domains; T1596 Search Open Technical Databases

Impact

T1657 Financial Theft

stealth

T1684.001 Impersonation

Remediation for Crypto wrench attacks 2026

Patches

  • Not applicable — this is a physical-coercion attack vector, not a software vulnerability; no code patch mitigates it

Immediate actions

  • Remove or scrub public associations between personal identity and specific wallet addresses/holdings (social media, forums, podcast appearances)
  • Avoid publicly disclosing crypto wealth, investment gains, travel plans, home address, or family details on social platforms, especially Instagram/TikTok
  • Brief family members, employees, drivers, and assistants on wrench-attack warning signs; they are increasingly targeted as lower-security proxy victims
  • Report surveillance, suspicious approaches, or threats to law enforcement immediately rather than confronting suspects

Workarounds

  • Maintain a decoy/low-balance wallet that can be surrendered under duress while primary holdings remain in multisig or third-party custody
  • Limit single-signer authority over high-value wallets so physical coercion of one person cannot unlock full funds

Longer-term hardening

  • Adopt multi-signature or distributed/time-locked custody schemes so no single coerced individual can unilaterally move significant funds
  • Engage professional physical-security/executive-protection services for high-net-worth or publicly known holders
  • Install home security systems (alarms, cameras, safe rooms) and vary routines/routes for known holders
  • Establish a pre-agreed duress protocol (e.g., a decoy wallet or duress PIN revealing only a small balance) for coercion scenarios

Affected and fixed versions

  • N/A (individuals, not a software vendor) — Self-custodied cryptocurrency wallet holders (investors, traders, executives, founders, influencers) and their families/staff
    Vulnerable versions: Single-signer self-custody with publicly discoverable wallet-identity linkage and no duress protocol
    Fixed in: Multi-signature/distributed custody, undisclosed wallet-identity linkage, defined duress protocols, professional physical security

Timeline of Crypto wrench attacks 2026

  • Danny Aston, UK cryptocurrency trader, forced at gunpoint in Moulsford, Oxfordshire, to transfer Bitcoin after four armed men broke into his home — one of the first reported UK crypto home invasions.
  • A Canterbury Christ Church University student is held at knifepoint by eight men and forced to transfer £6,000 in Bitcoin plus a £3,000 student loan.
  • A London teen gang conducts a series of knifepoint crypto-app robberies through 2021-2022, stealing a total of £115,000.
  • locked-ioc-13 sentenced to 47 years for leading a SIM-swapping and armed home-invasion crew that stole over $3.5M from cryptocurrency holders.
  • Hardware wallet stolen from a New Mexico home after a criminal operation tracked individuals believed to hold large crypto balances.
  • locked-ioc-17 and co-conspirators remotely track a Washington DC victim via a compromised iCloud account and steal over 4,100 BTC (~$230M) in an armed robbery, later charged under RICO.
  • locked-ioc-21 co-founder locked-ioc-14 and his partner kidnapped from their central-France home; attackers demand €10M and allegedly sever a finger before French authorities rescue the victims.
  • locked-ioc-19 publishes 'The Rise of Wrench Attacks and Crypto-related Violent Crime,' formally documenting the escalating global pattern.
  • Father of a Paris crypto entrepreneur abducted; perpetrators demand €5-7M and sever a finger. Victim rescued after 58 hours; five suspects arrested.
  • Masked attackers attempt to abduct the daughter and grandson of a Paris cryptocurrency executive; the attempt is disrupted by relatives and bystanders.
  • locked-ioc-13 receives an additional 6 years 10 months for assaulting a witness who testified against him at trial.
  • Court documents made public revealing a Vancouver, BC locked-ioc-15 in which victims were waterboarded, a family member sexually assaulted, and over $1.5M in Bitcoin stolen.
  • CryptoUK hosts a law-enforcement webinar addressing the rising wrench-attack threat.
  • CoinDesk reports wrench attacks jumped 75% in 2025, citing 72 confirmed physical-violence incidents with Europe accounting for over 40% of the global total and France leading at 19 attacks.
  • UK-based crypto figure 'Sillytuna' held down by four assailants under weapons/rape threats and forced to transfer approximately $24M in aEthUSDC.
  • A mother and child are kidnapped in France in a crypto-motivated wrench attack.
  • locked-ioc-20 releases the Intel3D H1 2026 Wrench Attacks Report: 52 verified global incidents (33% YoY increase), $124.1M in recorded financial exposure (~12x H1 2025), 79.6% of cases in Europe.
  • Cyber Security News publishes 'Wrench Attacks Bypass Encryption,' citing locked-ioc-19 research and prompting this threat record.

Sources cited for Crypto wrench attacks 2026

Previous and next in threat intel

Further reading

Drafted by the Threadlinqs research pipeline from 13 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats