France Logs 90 Bitcoin (BTC) “Wrench Attack” Cases in Seven Months

90 Crypto Cases in Seven Months

France has become the riskiest jurisdiction in the world for Bitcoin holders and other crypto investors whose personal data is publicly identifiable, and its own police records now put a number on that danger. Interior Ministry data shows 90 cryptocurrency-linked cases of kidnapping, extortion, personal threats and violent robbery between January 1 and mid-August 2026, a span of just over seven months in which police arrested 223 people and courts jailed 126 of them. That pace works out to roughly one new case every 2.5 days. There is no earlier baseline: the ministry says registration of this incident category only began on January 1, 2026, so officials cannot yet say whether the violence worsened or simply went uncounted.

The official figures run far above what public trackers had recorded. As of mid-2026, publicly documented wrench attacks, the term for physical coercion used to force a holder to surrender crypto, stood at 30 in France, a count the blockchain analytics firm Chainalysis itself calls “certainly larger” in practice. Security firm gart.io counted 73 attacks in France so far this year, the highest total of any country, ahead of the United States at 66 and the United Kingdom at 27. Jameson Lopp, a long-time Bitcoin (BTC) security researcher, has catalogued 365 physical attacks across 60 countries between 2014 and 2026, with France at the top of that list. Chainalysis data shows the violence spreading beyond the capital to Strasbourg, Marseille, Grenoble, Toulouse and Nantes. The victims are not visiting tourists: 93% of attacked holders whose residence is known are French nationals. Chainalysis chief researcher Eric Jardine says the surge “very likely” traces to a mass data leak, one that exposed not just financial records but who holds crypto, where they live and how to reach them. The run-up in the Bitcoin (BTC) price has made personal wealth easier to infer, and that is what turns a data breach into a doorstep threat.

The Leaks That Marked the Targets

Two separate breaches gave attackers their lists. In 2024, a tax office employee in Paris leaked the identities, financial files and crypto-asset holdings of French taxpayers, and Chainalysis records show the attack count climbing from late November of that year. A second leak followed in January 2026 at Waltio, a service that files crypto tax declarations, again handing criminals a ready-made roster of names, addresses and holdings. Bull Bitcoin (BTC) founder Francis Pouliot has repeatedly challenged the EU's DAC8 framework, which widens tax-reporting and information-sharing obligations for European crypto users, arguing it has turned “know your customer” into “kill your customer”, and calling France the “crypto kidnapping capital of the world”.

The targeting has also moved past the holder. By early 2026, relatives and acquaintances made up roughly 25% to 30% of victims in crypto violence worldwide; in France the share tops 40%. In May 2026, six suspects tried to abduct the wife of entrepreneur Sébastien Borget, with one attacker posing as a courier to get the door opened. In August, a couple in rural France endured three attempted break-ins at a house whose previous owner was a crypto whale, after the owner's tax details and address surfaced on the dark web. The year before, kidnappers seized the father of a crypto founder, reportedly severed part of his finger and mailed it to his son, demanding $5.6 million in crypto for the release. French authorities classify the wave as organized crime and route investigations through JUNALCO, the specialized organized-crime judicial unit. Jardine says the shift toward relatives shows the crews research thoroughly before they act, combining social media monitoring, on-chain analysis, leaked records and insider tips.

Custody Now Starts With Identity

The French record exposes a specific failed assumption: that security begins at the key. Hardware wallets, passphrase discipline and phishing checks all assume the attacker does not already know who you are and where you sleep. Once leaked filings do the reconnaissance, that assumption collapses, and the long-term HODL in self-custody becomes the most exposed position rather than the safest. Routing exposure through an ETF wrapper removes the individual from the target list, though DAC8 means the institution now holds the same identifying data. Privacy-preserving cryptography such as zero-knowledge proofs could shrink what reporting systems store, but it cannot recall what has already leaked. Cryptography protects the key; it does nothing against a $5 wrench.