France Logs 90 Bitcoin (BTC) “Wrench Attack” Cases in Seven Months

Update 18:46 UTC: The global catalogue of physical crypto attacks has grown sharply: Jameson Lopp's public repository of wrench-attack incidents now holds roughly 702 cases, up from the 365 he had catalogued earlier, after researcher Pizza Bitcoiner used AI-assisted search of local-language articles, court files and…

90 Crypto Cases in Seven Months

France has become the riskiest jurisdiction in the world for Bitcoin holders and other crypto investors whose personal data is publicly identifiable, and its own police records now put a number on that danger. Interior Ministry data shows 90 cryptocurrency-linked cases of kidnapping, extortion, personal threats and violent robbery between January 1 and mid-August 2026, a span of just over seven months in which police arrested 223 people and courts jailed 126 of them. That pace works out to roughly one new case every 2.5 days. There is no earlier baseline: the ministry says registration of this incident category only began on January 1, 2026, so officials cannot yet say whether the violence worsened or simply went uncounted.

The official figures run far above what public trackers had recorded. As of mid-2026, publicly documented wrench attacks, the term for physical coercion used to force a holder to surrender crypto, stood at 30 in France, a count the blockchain analytics firm Chainalysis itself calls “certainly larger” in practice. Security firm gart.io counted 73 attacks in France so far this year, the highest total of any country, ahead of the United States at 66 and the United Kingdom at 27. Jameson Lopp, a long-time Bitcoin (BTC) security researcher, has catalogued 365 physical attacks across 60 countries between 2014 and 2026, with France at the top of that list. Chainalysis data shows the violence spreading beyond the capital to Strasbourg, Marseille, Grenoble, Toulouse and Nantes. The victims are not visiting tourists: 93% of attacked holders whose residence is known are French nationals. Chainalysis chief researcher Eric Jardine says the surge “very likely” traces to a mass data leak, one that exposed not just financial records but who holds crypto, where they live and how to reach them. The run-up in the Bitcoin (BTC) price has made personal wealth easier to infer, and that is what turns a data breach into a doorstep threat.

Chainalysis has added a caveat to its own narrative: while the 2024 tax-office leak and the January 2026 Waltio breach are suspected of feeding attackers their target lists, the firm says no direct connection between individual attacks and either leak has been confirmed. It also cautions that the ministry's 90 cases and its publicly documented count of 30 use different scopes and criteria, so the two figures cannot be compared directly. What the firm does affirm is that wallet security alone cannot stop physical coercion, since an exposed identity and home address turn an online theft problem into a doorstep one, which is why investigators route these cases through JUNALCO rather than treating them as ordinary robbery.

The global catalogue of physical crypto attacks has grown sharply: Jameson Lopp's public repository of wrench-attack incidents now holds roughly 702 cases, up from the 365 he had catalogued earlier, after researcher Pizza Bitcoiner used AI-assisted search of local-language articles, court files and police records to surface previously missed incidents. A separate database assembled from that effort counts 670 cases across 72 countries from January 2020 to mid-October 2026, of which 375 were absent from Lopp's collection. That database logs 413 victims forcibly detained, 300 injured and 31 killed, with losses of about $394 million across the 447 cases where amounts are recorded. Annual records rose from 37 incidents in 2020 to 165 in 2025, though both collections rely on publicly documented events, the deduplication has not been independently verified, and neither figure implies the true total, which researchers say is larger.

The Leaks That Marked the Targets

Two separate breaches gave attackers their lists. In 2024, a tax office employee in Paris leaked the identities, financial files and crypto-asset holdings of French taxpayers, and Chainalysis records show the attack count climbing from late November of that year. A second leak followed in January 2026 at Waltio, a service that files crypto tax declarations, again handing criminals a ready-made roster of names, addresses and holdings. Bull Bitcoin (BTC) founder Francis Pouliot has repeatedly challenged the EU's DAC8 framework, which widens tax-reporting and information-sharing obligations for European crypto users, arguing it has turned “know your customer” into “kill your customer”, and calling France the “crypto kidnapping capital of the world”.

The targeting has also moved past the holder. By early 2026, relatives and acquaintances made up roughly 25% to 30% of victims in crypto violence worldwide; in France the share tops 40%. In May 2026, six suspects tried to abduct the wife of entrepreneur Sébastien Borget, with one attacker posing as a courier to get the door opened. In August, a couple in rural France endured three attempted break-ins at a house whose previous owner was a crypto whale, after the owner's tax details and address surfaced on the dark web. The year before, kidnappers seized the father of a crypto founder, reportedly severed part of his finger and mailed it to his son, demanding $5.6 million in crypto for the release. French authorities classify the wave as organized crime and route investigations through JUNALCO, the specialized organized-crime judicial unit. Jardine says the shift toward relatives shows the crews research thoroughly before they act, combining social media monitoring, on-chain analysis, leaked records and insider tips.

Custody Now Starts With Identity

The French record exposes a specific failed assumption: that security begins at the key. Hardware wallets, passphrase discipline and phishing checks all assume the attacker does not already know who you are and where you sleep. Once leaked filings do the reconnaissance, that assumption collapses, and the long-term HODL in self-custody becomes the most exposed position rather than the safest. Routing exposure through an ETF wrapper removes the individual from the target list, though DAC8 means the institution now holds the same identifying data. Privacy-preserving cryptography such as zero-knowledge proofs could shrink what reporting systems store, but it cannot recall what has already leaked. Cryptography protects the key; it does nothing against a $5 wrench.