Attacks on crypto investors are becoming an increasingly noticeable threat: since the beginning of 2026, victims of physical extortion have lost cryptocurrency worth over $30 million, according to analytics company Chainalysis. If the trend continues, 2026 could become one of the toughest years in terms of such crimes.
For comparison: for the entire year of 2025, the amount stolen in this way reached a record $58 million. However, the $30 million figure only takes into account completed thefts, where victims were forced to transfer assets to criminals.
If you add unsuccessful extortion attempts, where the funds were blocked or frozen, the total damage for 2026 rises to $107 million. In the broader Chainalysis statistics, the dynamics look like this:
- 2024: $316 million.
- 2025: $180 million.
- 2026: $107 million including unsuccessful extortion attempts.
Even these amounts may be lower than the real figures. The calculations only include known and registered cases, and some victims may not contact law enforcement agencies.
Why Attacks on Cryptocurrency Owners Have Increased
On the blockchain analytics market, the roles are distributed as follows:
- Chainalysis: blockchain transaction analysis, assistance to government agencies, law enforcement, crypto exchanges, and AML services.
- TRM Labs: tracking the movement of funds and suspicious wallets.
- Elliptic: analysis of asset origins.
- CertiK: research on technical risks in the ecosystem.
Such crimes are often called “Wrench Attacks”: it is not about hacking an exchange, app, or smart contract, but about putting pressure on a specific person. In such cases, cryptocurrency becomes the target of physical extortion, not a cyberattack.
The situation has changed especially sharply in France. Until 2025, there were only isolated incidents of violence related to crypto assets. In 2025, there were 19 such cases, and in just the first half of 2026, analysts counted 30 publicly known incidents.
One possible reason is considered to be a major leak of personal data of crypto investors. In 2024, in France, a tax office employee from the Paris region was accused of stealing and selling dossiers on wealthy digital asset holders. According to the investigation, these files contained names, addresses, phone numbers, tax records, and information about the size of assets.
The problem is acknowledged by the French authorities as well. Interior Minister Laurent Nunez stated that law enforcement had documented nearly 80 such crimes, and concerns about this topic are fully justified. The geography of attacks is no longer limited to Paris: cases have been recorded in Strasbourg, Marseille, Grenoble, Toulouse, Nantes, and small communes where this almost never happened before.
How Criminals’ Tactics Have Changed
In Europe, France has become the most prominent hotspot, but the problem is not limited to one country. Chainalysis notes that criminals are increasingly putting pressure not only on crypto owners themselves but also on their families or loved ones. If in 2021 such episodes were almost nonexistent, by early 2026 they accounted for about 30% of such attacks worldwide. In France, the share is even higher: more than 40% of cases are related to victims’ relatives or acquaintances.
The format of attacks is also changing:
- Home invasions: 14% in 2025 and 37% in 2026.
- Kidnappings: 52% of the overall structure of such crimes.
At the same time, some French cases, depending on classification, can be attributed not to kidnappings but to home invasions, which would make this category the most common.
The majority of victims are not tourists but local residents:
- France: 93%.
- Brazil: 82%.
- USA: 77%.
This statistic indicates not random attacks, but prior reconnaissance: criminals choose a target in advance, gather information, and plan their pressure.
Here, physical violence is often combined with what is called social engineering in the digital environment: criminals need data about the asset owner, their habits, addresses, circle, and ways of storing funds. Therefore, the risk arises not only for those who keep coins in personal wallets but also for users of major platforms like Coinbase or local services if information about them falls into the wrong hands.
What Crypto Attacks Are Used Against Investors
Physical extortion is just one scenario. Risks for cryptocurrency owners often begin with an attempt to gain access to a wallet, account, or personal data.
- Phishing: fake websites, emails, or messages trick users into giving up a seed phrase, password, or confirmation code.
- Exchange and service hacks: criminals attack the platform’s infrastructure, not an individual user.
- Smart contract exploits: attackers use a bug in the smart contract code.
- Wallet attacks: the target is private keys, seed phrases, devices, or cloud backups.
- Skimming: payment or access data is intercepted through fake forms and malicious tools.
- Social engineering: a person is convinced to reveal data or transfer assets themselves.
- SIM swapping: the phone number is transferred to the attacker’s SIM card to intercept SMS codes and access accounts.
This also includes fake investment projects, ICO scams, and Ponzi schemes: victims are promised returns and then the collected funds are withdrawn.
High-Profile Losses and Scams
A separate risk category is loss of access to assets or a major scam. Among the most famous examples, James Howells is often mentioned, who is associated with the loss of 8,000 bitcoins. In fraudulent schemes, victims are investors who believed in fake projects, Ponzi schemes, or promises of guaranteed returns.
Why Criminals Are Less Likely to Get a Ransom
As the number of attacks grows, the effectiveness of such attacks is decreasing. By the end of June 2026, only 26% of theft attempts ended with a transfer of funds. In 2025, the figure was 49%, and in 2024 — 67%.
Chainalysis links this to the fact that in France, there are now more crude and less targeted attacks. They have displaced the more carefully prepared crimes of previous years, where criminals had a better chance of forcing the victim to transfer assets.
A separate issue is the further movement of stolen funds. Money laundering schemes can be simple or complex:
- Sending assets to centralized exchanges.
- Using online digital currency exchange services.
- Using decentralized exchanges.
- Using cross-chain tools.
- Creating long chains of transfers to complicate tracking.
If such funds are cashed out illegally, the consequences depend on the country and circumstances: possible asset freezes, fines, sanctions, and criminal liability.
Earlier, Chainalysis noted that the largest losses by amount were usually suffered by bitcoin owners. At the same time, bitcoin holders became targets of targeted thefts less often than owners of some other crypto assets.
How to Reduce the Risk of Cryptocurrency Theft
Technical protection does not eliminate personal safety, but it greatly reduces the risk of theft through an account or wallet.
- Store private keys and seed phrases offline, without screenshots, cloud notes, or sending via messengers.
- Use a hardware wallet for large amounts and do not connect it to suspicious sites.
- Enable two-factor authentication, preferably via app or hardware key, not SMS.
- Check the website, contract, and recipient address before transferring funds.
- Do not publicly disclose the size of your portfolio, home address, habits, or routes.
- Monitor personal data leaks and change access methods if your phone or email may have been compromised.
For digital asset owners, privacy becomes part of security: a leak of address, phone, or asset information can be as dangerous as a weak password.
The main conclusion for the market remains alarming: criminals are increasingly shifting pressure from online to the real world. For digital asset owners, this means that security is no longer limited to a strong password, hardware wallet, or Telegram account protection. Privacy, control over personal data leaks, and caution in publicly discussing your investments are becoming increasingly important.
{
“@context”: “https://schema.org”,
“@type”: “Article”,
“about”: [
{
“@type”: “Thing”,
“name”: “Cryptocurrency”
},
{
“@type”: “Place”,
“name”: “France”
},
{
“@type”: “Place”,
“name”: “Europe”
},
{
“@type”: “Organization”,
“name”: “CertiK”
},
{
“@type”: “Product”,
“name”: “Bitcoin”
},
{
“@type”: “Organization”,
“name”: “Coinbase”
},
{
“@type”: “Thing”,
“name”: “Social Engineering”
},
{
“@type”: “Thing”,
“name”: “Money Laundering”
}
]
}
