# Wrench Attacks: Physical Coercion Bypasses Cryptocurrency Wallet Encryption Amid 33% YoY Surge in H1 2026

> Blockchain-security firms TRM Labs and CertiK document a sharply escalating global pattern of 'wrench attacks' — kidnapping, home invasion, torture, and extortion used to physically coerce cryptocurrency holders (and their families/employees) into surrendering keys or approving transfers. CertiK's Intel3D H1 2026 report verified 52 incidents worth $124.1M in exposure (up 33% YoY, ~12x the dollar losses of H1 2025), concentrated in France, the UK, the US, and Canada, with Europe accounting for 79.6% of cases.

- **Published:** 2026-07-28T00:00:00Z
- **Last reviewed:** 2026-07-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1737
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-crypto-wrench-attacks-2026-tl-2026-1737.webp?v=deb4f429 (Threadlinqs threat intel: CertiK Intel3D Wrench Attack Exposure: Analysis & Hunting (TL-2026-1737) — High severity, 21 IOCs, 9 detection rules.)
- **ID:** TL-2026-1737
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 21

## Description

"Wrench attacks" — named for the xkcd "$5 wrench" rubber-hose-cryptanalysis joke — describe a non-technical attack vector in which adversaries bypass wallet encryption entirely by targeting the human holding the key rather than the cryptography itself. Victims are coerced through home invasion, kidnapping-for-ransom, armed/knifepoint robbery, torture, or credible threats of violence against themselves or family members until they unlock a wallet, disclose a seed phrase, or approve an on-chain transfer under duress.

The pattern has escalated sharply through 2025-2026. TRM Labs recorded roughly 55 wrench attacks globally in 2025 (the worst year on record at the time), while independent tracker Jameson Lopp's 'physical-bitcoin-attacks' GitHub list logged over 70 incidents in the same period and now exceeds 200 entries since 2014, with a 169% increase in reported attacks in the first six months of 2025 alone. CertiK's Intel3D H1 2026 Wrench Attacks Report — the most current authoritative dataset — verified 52 distinct global incidents in H1 2026, a 33% year-over-year increase from 39 in H1 2025, with total recorded financial exposure jumping to $124.1 million (versus $10.5M in H1 2025), an almost 12-fold increase. Average exposure per incident rose from roughly $270,000 to $2.39 million. Home invasion overtook kidnapping as the most common method (20 vs. 1 incident YoY), kidnappings rose from 12 to 16, and the report recorded 4 torture incidents and 1 murder. Europe accounted for 79.6% of verified H1 2026 incidents, with France alone responsible for 33 incidents (63.5% of the global total).

Named incidents anchor the pattern: Ledger co-founder David Balland and his partner were kidnapped from their central-France home in January 2025 (€10M ransom demand, finger severed, rescued after ~24 hours); in May 2025 the daughter and grandson of a Paris crypto executive narrowly escaped an abduction attempt, and separately the father of a crypto entrepreneur was kidnapped and held 58 hours under a €5-7M ransom demand (finger severed, five suspects arrested); in a Vancouver, Canada home invasion (court records unsealed November 2025) victims were waterboarded and a family member sexually assaulted while $1.5M in Bitcoin was stolen; in March 2026 a UK-based crypto figure ('Sillytuna') was held down by four assailants under threats of weapons and rape and forced to transfer roughly $24M in stablecoin; and in April 2026 a mother and child were kidnapped in France. In the US, DOJ prosecutors used RICO organized-crime statutes against a 13-defendant conspiracy (fronted by Malone Lam) that stole over $230-263M in cryptocurrency via SIM-swapping and home invasions, in one case remotely tracking a Washington DC victim's real-time physical location through a compromised iCloud account to coordinate an armed robbery on August 18, 2024. A related, earlier home-invasion crew led by Remy Ra St Felix combined SIM-swapping with gunpoint robbery to steal $3.5M+; St Felix was sentenced to 47 years, later extended by 6 years 10 months for assaulting a trial witness. UK cases date back to 2018 (Danny Aston, Oxfordshire, gunpoint Bitcoin transfer) and include a 2021 knifepoint robbery of a university student and a 2021-2022 London teen-gang spree that stole £115,000 via crypto-app muggings.

TRM Labs researchers (Ari Redbord, Phil Ariss) attribute the rise to three converging factors: cryptocurrency's mainstream adoption expanding the pool of visible, reachable targets; the perceived irreversibility/pseudonymity of on-chain transfers making crypto holders attractive relative to traditional banking targets; and criminals' increasing use of social media (Instagram, TikTok, podcast appearances) for OSINT-driven wealth-signal profiling and victim identification. Attackers increasingly target proxy victims — a holder's spouse, parent, child, employee, driver, or assistant — who often have weaker personal security and more predictable routines than the primary target. Analysts also note 'violence-as-a-service' overlap between established cybercrime networks (loosely termed 'The Com'/'IRL Com', overlapping with Scattered Spider/UNC3944-adjacent actors) and organized crime groups willing to conduct in-person robbery and extortion. Law enforcement response includes blockchain-forensics tracing (Coinbase cooperation enabled UK convictions), DOJ RICO prosecutions, and law-enforcement training initiatives (e.g., a December 2025 CryptoUK webinar), but police in most jurisdictions are widely assessed as under-resourced and under-trained for this crime pattern, and incidents are believed to be significantly underreported.

This threat has no CVE, no exploit code, and no traditional network/malware IOCs — it is documented here as a physical/OSINT threat vector materially relevant to high-net-worth and publicly identifiable cryptocurrency holders, their families, and their staff.

## MITRE ATT&CK

- T1593 Search Open Websites/Domains
- T1591 Gather Victim Org Information
- T1589 Gather Victim Identity Information
- T1596 Search Open Technical Databases
- T1586 Compromise Accounts
- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1684.001 Impersonation
- T1451 SIM Card Swap
- T1111 Multi-Factor Authentication Interception
- T1430 Location Tracking
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Compromised-Account Location-Polling Spike Correlated with OSINT Recon and High-Value Transfer** (`TL-2026-1737-SPL-003`)

Detects a cloud-identity session-token reissuance on an unrecognized device followed by an anomalous spike (>4 polls within 30 minutes) in device-location/Find-My-style API calls — the pattern from the Malone Lam RICO case where a compromised iCloud account was abused to remotely track a victim's real-time location ahead of an armed robbery — optionally correlated with prior OSINT-style wealth-signal/proxy-victim recon and a subsequent high-value cryptocurrency transfer approval, representing the full surveillance-to-financial-theft chain that enables physical wrench-attack coercion.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1586, T1430, T1657, T1593, T1596, T1591, T1589
- **Data sources:** cloud_identity_account_activity, cloud_location_api_logs, crypto_custodian_transfer_approval_log, web_proxy_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=cloud_identity sourcetype="cloud:identity:accountactivity" event_type="session_token_reissue" device_trust="unrecognized"
| eval reissue_time=_time, account=user
| fields account, reissue_time
| join type=inner account
    [ search index=cloud_identity sourcetype="cloud:identity:location_api" (api="find_my" OR api="device_location")
      | eval poll_time=_time
      | stats count as poll_count, min(poll_time) as first_poll, max(poll_time) as last_poll by account ]
| where poll_count>4 AND (first_poll-reissue_time)<=1800
| join type=left account
    [ search index=crypto_custody sourcetype="custodian:transfer_approval" amount_usd>100000
      | eval transfer_time=_time
      | fields account, transfer_time, amount_usd, destination_wallet ]
| table account, reissue_time, poll_count, first_poll, last_poll, transfer_time, amount_usd, destination_wallet
| sort - last_poll
```

### Microsoft KQL

```kql
let SuspiciousSessions = CloudAppEvents
    | where TimeGenerated > ago(24h)
    | where ActionType in ("TokenReissued", "LogonUser")
    | where DeviceTrustType == "Unmanaged"
    | project ReissueTime = TimeGenerated, AccountId, DeviceTrustType;
let LocationPolls = CloudAppEvents
    | where TimeGenerated > ago(24h)
    | where ActionType in ("FindMyDeviceQuery", "DeviceLocationQuery")
    | summarize PollCount = count(), FirstPoll = min(TimeGenerated), LastPoll = max(TimeGenerated) by AccountId;
let Transfers = CryptoTransferApprovals_CL
    | where TimeGenerated > ago(24h)
    | where AmountUsd_d > 100000
    | project TransferTime = TimeGenerated, AccountId = AccountId_s, AmountUsd_d, DestinationWallet_s;
SuspiciousSessions
| join kind=inner LocationPolls on AccountId
| where (FirstPoll - ReissueTime) between (0min .. 30min) and PollCount > 4
| join kind=leftouter Transfers on AccountId
| project AccountId, ReissueTime, PollCount, FirstPoll, LastPoll, TransferTime, AmountUsd_d, DestinationWallet_s
```

### Sigma

```yaml
title: Compromised-Account Location-Polling Spike Correlated with OSINT Wealth-Signal Recon and High-Value Transfer
id: 8f2a1c40-9e3b-4c7d-9f21-1737aa000003
status: experimental
description: Detects a session-token reissuance on an unrecognized device followed by an anomalous spike in device-location/Find-My-style API polling, optionally correlated with prior OSINT-style reconnaissance (social-media wealth-signal profiling, public wallet-disclosure lookups, proxy-victim identification) and a subsequent high-value cryptocurrency transfer approval — the compromised-account surveillance pattern used to physically locate and coerce wrench-attack victims (Malone Lam RICO case pattern).
references:
    - https://www.justice.gov/usao-dc/pr/additional-12-defendants-charged-rico-conspiracy-over-263-million-cryptocurrency-thefts
    - https://www.trmlabs.com/resources/blog/the-rise-of-wrench-attacks-and-crypto-related-violent-crime
    - https://github.com/jlopp/physical-bitcoin-attacks
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-28
tags:
    - attack.collection
    - attack.resource-development
    - attack.reconnaissance
    - attack.impact
    - attack.t1586
    - attack.t1430
    - attack.t1657
    - attack.t1593
    - attack.t1596
    - attack.t1591
    - attack.t1589
logsource:
    category: application
    product: cloud_account_activity
detection:
    selection_reissue:
        EventType: 'session_token_reissue'
        DeviceTrust: 'unrecognized'
    selection_location_poll:
        Api:
            - 'find_my'
            - 'device_location'
    selection_osint_recon:
        DestinationHost|contains:
            - 'wallet-explorer'
            - 'instagram.com'
            - 'tiktok.com'
        QueryString|contains:
            - 'net worth'
            - 'portfolio'
            - 'hodl'
    selection_high_value_transfer:
        AmountUsd: '>100000'
    timeframe: 24h
    condition: (selection_reissue and selection_location_poll) or (selection_osint_recon and selection_high_value_transfer)
falsepositives:
    - Legitimate device replacement with Find My re-enabled by the account owner shortly after
    - Corporate OSINT/brand-protection team's own authorized monitoring queries (should be allowlisted by source account)
level: high
```

**Known false positives:**

- Legitimate device replacement with Find My/location services re-enabled by the account owner shortly after migration
- Corporate OSINT/brand-protection or executive-protection team's own authorized monitoring queries against the same wealth-signal/wallet-explorer sources

**Tuning notes:** Requires personal/executive cloud-account activity telemetry (via consented VIP-protection monitoring or MDM integration), a custodian/exchange transfer-approval audit feed, and web-proxy visibility into OSINT/wallet-explorer lookups; allowlist the security team's own authorized monitoring source accounts and tune the $100k transfer threshold to the protected population's typical holdings.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SIM Port-Out Alert Followed by MFA Method Change on Monitored High-Value Identity (locked: unlock with TL Creds)
- Helpdesk Impersonation Bypasses Knowledge-Based Auth Preceding Account Recovery (locked: unlock with TL Creds)
- Compromised-Account Location-Polling Spike Correlated with OSINT Recon and High-Value Transfer (locked: unlock with TL Creds)
- SIM Port-Out Alert Followed by MFA Method Change on Monitored High-Value Identity (locked: unlock with TL Creds)
- Helpdesk Impersonation Bypasses Knowledge-Based Auth Preceding Account Recovery (locked: unlock with TL Creds)
- Compromised-Account Location-Polling Spike Correlated with OSINT Recon and High-Value Transfer (locked: unlock with TL Creds)
- SIM Port-Out Alert Followed by MFA Method Change on Monitored High-Value Identity (locked: unlock with TL Creds)
- Helpdesk Impersonation Bypasses Knowledge-Based Auth Preceding Account Recovery (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Wrench Attacks Bypass Encryption](https://cybersecuritynews.com/wrench-attacks-bypass-encryption/)
- [The Rise of Wrench Attacks and Crypto-related Violent Crime](https://www.trmlabs.com/resources/blog/the-rise-of-wrench-attacks-and-crypto-related-violent-crime)
- [H1 2026 Crypto Hacks Reach Record High as Losses Fall Below USD 1 Billion](https://www.trmlabs.com/resources/blog/h1-2026-crypto-hacks-reach-record-high-as-losses-fall-below-usd-1-billion)
- [Crypto wrench attacks to surge following a violent 2025](https://www.dlnews.com/articles/regulation/crypto-wrench-attacks-to-surge-following-a-violent-2025/)
- ['Wrench' attacks against crypto holders appear to be on the rise](https://therecord.media/wrench-attacks-against-cryptocurrency-holders)
- [CertiK Intel3D: H1 2026 Wrench Attacks Report Reveals 33% Surge in Physical Crypto Crime, Estimated Losses Top $124 Million](https://www.globenewswire.com/news-release/2026/07/25/3333162/0/en/CertiK-Intel3D-H1-2026-Wrench-Attacks-Report-Reveals-33-Surge-in-Physical-Crypto-Crime-Estimated-Losses-Top-124-Million.html)
- [Crypto Wrench Attacks Exposed $124M in H1 2026: CertiK Report](https://www.cryptotimes.io/2026/07/23/crypto-wrench-attacks-exposed-124m-in-h1-2026-certik-report/)
- [Wealthy Crypto Individuals Face 'Wrench' Attacks](https://www.silicon.co.uk/e-enterprise/financial-market/wealthy-crypto-individuals-face-physical-wrench-attacks-616106)
- [Solace Global - Wrench Attacks: Growing Physical Threats to Crypto Holders](https://www.solaceglobal.com/report/crypto-wrench-attacks-2026/)
- [Crypto crime is getting violent: 'wrench attacks' jumped 75% in 2025](https://www.coindesk.com/markets/2026/02/02/crypto-crime-is-getting-violent-wrench-attacks-jumped-75-in-2026)
- [physical-bitcoin-attacks — known attacks against Bitcoin/crypto asset owning entities](https://github.com/jlopp/physical-bitcoin-attacks)
- [DOJ: Additional 12 Defendants Charged in RICO Conspiracy for over $263 Million Cryptocurrency Thefts, Money Laundering, Home Break-Ins](https://www.justice.gov/usao-dc/pr/additional-12-defendants-charged-rico-conspiracy-over-263-million-cryptocurrency-thefts)
- [$250M crypto-robbing gang's dirty work guy sentenced to 6.5 years behind bars](https://www.theregister.com/cyber-crime/2026/05/07/250m-crypto-robbing-gangs-dirty-work-guy-sentenced-to-65-years-behind-bars/5234787)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1737