Wrench Attacks Bypass Encryption by Forcing Victims to Unlock Crypto Wallets
Criminals are increasingly using physical violence and threats to force cryptocurrency owners to unlock wallets or approve transactions, bypassing digital security through coercion.
Cryptocurrency theft is evolving beyond purely digital exploits, with a disturbing trend of "wrench attacks" emerging globally. These incidents involve criminals using physical violence, threats, home invasions, and even kidnapping attempts to coerce victims into unlocking their cryptocurrency wallets or authorizing fund transfers under duress. Instead of targeting software vulnerabilities, these attacks exploit the human element, leveraging coercion to bypass robust encryption and security measures.
Analysts at TRM Labs have identified a growing pattern of these physical assaults targeting individuals associated with significant digital asset wealth. This includes investors, traders, corporate executives, and their family members. The trend highlights how public exposure of cryptocurrency holdings can translate into severe real-world safety risks. Incidents have been reported in multiple countries, including France, the United States, the United Kingdom, and Canada, blurring the lines between sophisticated cybercrime and conventional violent crime.
The appeal of cryptocurrency to criminals lies in the speed and irreversibility of transactions, making recovery difficult for victims. Unlike typical online compromises such as malware or phishing, wrench attacks do not rely on technical exploits. Instead, attackers physically compel victims to reveal passwords, unlock devices, surrender hardware wallets, or authorize transactions. This method exploits a fundamental security principle: even the strongest encryption is ineffective if the key holder is physically threatened.
France has been a notable hotspot for these attacks. In May 2025, an attempted abduction of a cryptocurrency executive's daughter and grandson in Paris was thwarted. Earlier that month, the father of another crypto entrepreneur was abducted, with perpetrators demanding a multi-million euro ransom. The victim was eventually rescued, and suspects were arrested. The report also cited the January 2025 kidnapping of Ledger co-founder David Balland and his partner, where attackers demanded a substantial ransom and allegedly injured Balland.
Similar cases have surfaced in the United States, where a criminal operation allegedly tracked individuals with large crypto balances. One incident involved a burglary where a hardware wallet was stolen from a New Mexico home. Attackers often combine online surveillance with physical targeting, using social media posts, public discussions of holdings, travel habits, and visible displays of wealth to profile potential victims before initiating contact.
TRM Labs emphasizes that a common thread in many wrench attacks is pre-offense victim profiling. Individuals who openly discuss their crypto holdings, post about wallet activity, or publicly link their identity to substantial assets face a heightened risk. The primary recommendation for cryptocurrency holders is discretion: avoid publicly linking wallet addresses to personal identities and exercise caution when sharing investment successes, travel plans, or personal details on social media.
Beyond discretion, TRM Labs suggests a layered security approach. For significant holdings, multi-signature wallets can add a crucial barrier by requiring multiple approvals for transactions. This mitigates the risk of a single coerced individual draining assets. Furthermore, individuals with a high public profile or substantial assets should consider enhanced physical security measures, including robust home security systems, secure transportation, and professional security support. Family members should also be educated on warning signs and protocols for reporting suspicious activity.
The rise of wrench attacks serves as a stark reminder that while encryption protects digital assets, it cannot protect individuals from physical threats. Limiting public exposure and preparing for potential physical coercion are now critical components of comprehensive cryptocurrency security, complementing traditional digital defenses.