Wrench attacks: why showing crypto online makes you a target, and what creators do instead

Violent robberies of crypto holders set a record in 2025, and London police found that nearly half of the cases they could trace began with what victims had made public. The numbers, how targets are picked, what creators stop showing, and how to keep a wallet in your videos without your own.

Published: 14 October 2026

What is a wrench attack?

If you make crypto content, you have probably seen the headlines: a holder kidnapped in France, a home invasion in the United States, a ransom demand sent to a family. Security researchers have a name for these crimes. A wrench attack is a physical attack in which someone uses violence, or the threat of violence, to force a crypto holder to hand over assets, for example by making them unlock a wallet or send a transfer under duress. Chainalysis lists home invasions, kidnappings and hostage situations as the usual forms.

The name comes from a 2009 xkcd comic called "Security". Two villains give up on cracking an encrypted laptop and settle on hitting its owner with a $5 wrench until he gives up the password. The joke is a threat model: the strongest encryption does nothing against a person who can be coerced.

Crypto makes the coercion pay. Chainalysis points out that holders keep wealth in a form that moves instantly and irreversibly, often in self-custody with no institutional gatekeeper in the way. A 2026 framework written by London's Metropolitan Police and TRM Labs makes the same point: with self-custody, there is no teller or branch manager at the point of coercion.

How common are wrench attacks?

Chainalysis, the blockchain analytics firm, tracks publicly known incidents worldwide. Its August 2026 report gives these figures.

Kidnappings made up 52% of incidents in 2026 and home invasions 37%, up from 26% in 2023. Attacks on a holder's relatives or acquaintances, rather than the holder, reached about 25 to 30% of cases by early 2026, and more than 40% in France. Victims were overwhelmingly local residents (93% in France, 77% in the United States), which Chainalysis reads as a sign of reconnaissance and planning.

Other counts use other methods but point the same way. Open-source research cited by TRM Labs found about 18 attacks in 2023, 24 in 2024 and roughly 70 in 2025. The Metropolitan Police identified 17 reported offenses in London alone between March and December 2024, most of them kidnappings (59%), with an average crypto loss of about £660,000 per offense. Every source says the real number is higher, because many cases are recorded as ordinary robberies or never reported.

Chainalysis also stresses that violent crypto attacks "remain rare events in absolute terms." The lesson is not that every holder is in danger. It is that the people who get targeted are rarely picked at random.

Where the cases are

France, the United States, Brazil and Thailand have the highest cumulative counts since 2023. France logged 30 publicly known incidents in the first half of 2026; in late June, its interior minister said authorities had documented more than 70 crypto-related violent incidents and announced plans for a rapid identification and alert system for people at risk. Chainalysis links the French surge to an alleged 2024 leak in which dossiers on crypto holders, with names, addresses, holdings and phone numbers, were taken from tax records and sold. By mid-2026, the French crackdown had produced around 200 arrests.

In New York, two men were indicted in 2025 on kidnapping, assault and coercion charges over the alleged 17-day captivity of a man in a Manhattan townhouse, where prosecutors say he was pressed for his bitcoin password. Both pleaded not guilty, and police said the people involved knew each other.

How attackers choose their targets

The Metropolitan Police reviewed how victims in its cases came to the attention of offenders, and found four pathways.

The largest pathway is the one a creator controls. In 2025, TRM Labs said criminals increasingly use social media to build assessments of potential targets, focusing on indicators of wealth, and that Instagram, TikTok and other short-form video apps are "frequently exploited" once a likely mark has been identified. The 2026 framework describes a London case from June 2024 in which a cryptocurrency influencer had $4.3 million in digital assets stolen at knifepoint during a burglary.

For a creator, the uncomfortable part is that the content is the exposure. A wallet total is a price tag, and so are the details around it: the room you film in, the view from the window, the car, the city in your bio, the gym you check in at every morning, the same handle on every platform. Kaspersky's guide to doxing notes that a username reused across services lets someone build a picture of how a person spends their time.

What crypto creators stop showing

Every report cited here starts with the same rule. Chainalysis: avoid publicly disclosing holdings, whether through social media, conference appearances or on-chain activity linked to a known identity. TRM Labs: refrain from disclosing crypto holdings on social media, and avoid publicly linking your identity to wallet addresses. As a production checklist, it looks like this.

Two of these rows have simple settings behind them. Apple's personal safety guide warns that people you share photos and videos with "may be able to access the location metadata and learn where it was taken", and shows how to turn location off before sharing. And Twitch suggests a stream delay on in-person streams so viewers cannot tell exactly where you are in real time.

If you really hold a lot

Content discipline lowers the odds of being picked. For people with significant holdings, the security firms add measures that are defensive by design.

• Custody that coercion alone cannot unlock. TRM Labs recommends multi-signature wallets, which need several approvals before funds move, for those holding significant assets. Chainalysis speaks of secure custody arrangements.
• Physical security matched to the risk. From an alarm system to professional protection, depending on the threat.
• A family briefing. TRM Labs advises explaining the risks to relatives, since they are targeted as proxies, and asking them to watch for unusual activity.
• Less personal data in fewer places. Leaks have fed attacks before: Chainalysis ties the French wave to stolen tax dossiers, and the London framework cites a 2020 breach of a hardware wallet maker's customer list, home addresses included, as an upstream factor in later cases.
• If you think you are being watched, TRM Labs says not to confront anyone, to document what you see and report it to local police, and to consider a professional security assessment.

Keeping a wallet in your videos without your own

Some formats still need a wallet on screen: a reaction to a pump, an explainer on what a portfolio looks like, a skit about buying the top. Filmed from your real wallet, each of them is the first row of the table above.

That is the gap a different kind of app fills. A larp wallet, also called a crypto wallet app simulator, is an app that shows a believable crypto wallet screen built from the balances you type in, for videos, skits, pitch decks and demos. It holds no funds and touches no blockchain. Nothing on the screen leads back to an address of yours, because there is none. My Larp Wallet, a paid app we make, is one of them (the larp wallet guide).

Where the line is

A simulated screen removes the exposure, not the perception. Viewers cannot tell a typed balance from a real one, so a screen showing a fortune can make you look like a target just as a real one would. Keep the numbers modest and obviously illustrative, keep a visible "Mockup" label in the frame, and say in the caption that the wallet is simulated.

And never present it as your holdings or your results. A mockup is a prop, never proof of anything, and passing it off as real is deception, which our terms of use forbid. How wealth gets staged online, and why audiences should doubt every screen, is covered in larping rich, prop by prop.

Sources

• Chainalysis, Violent Wrench Attacks Targeting Crypto Holders, 2026
• TRM Labs and Metropolitan Police Service, Wrench Attacks: A Crypto Crime Response Framework, 2026
• TRM Labs, The Rise of Wrench Attacks and Crypto-related Violent Crime, 2025
• xkcd, Security (comic 538), 2009
• ABC News, What we know about the NYC crypto kidnapping and torture case, 2025
• Apple Support, Personal Safety User Guide: Manage location metadata in Photos, 2026
• Twitch Help, How to Add Stream Delay, 2026
• Kaspersky, What is Doxing? How to Prevent It and What to Do if You are Doxed, 2026

Questions

What is a crypto wrench attack?

A physical attack in which someone uses violence, or the threat of violence, to force a crypto holder to hand over assets, for example by making them unlock a wallet or send a transfer under duress. Home invasions, kidnappings and hostage situations are the usual forms.

What does the $5 wrench mean in crypto?

It comes from a 2009 xkcd comic called Security. Two villains give up on cracking an encrypted laptop and decide to hit its owner with a $5 wrench until he gives up the password. The point: strong encryption does nothing against a person who can be coerced.

How do you protect yourself from wrench attacks?

Start with what you make public: no real holdings, gains or wallet addresses on social media, and nothing that links your identity to an address. Then keep your home, your real-time location and your family out of crypto content. People with significant holdings add custody that needs several approvals, physical security matched to their risk, and a briefing for relatives.

Are crypto influencers more at risk of being kidnapped?

Visibility is the risk factor. In the Metropolitan Police's review of London cases, voluntary exposure, which includes public posts about holdings and influencer profiles, accounted for 47% of identified cases, and TRM Labs says short-form video apps are frequently exploited once a likely target has been spotted.

How common are crypto kidnappings?

Kidnappings made up 52% of the violent crypto incidents Chainalysis recorded in 2026, out of 46 incidents worldwide through late June. Chainalysis also stresses that such attacks remain rare in absolute terms, and that the true count is higher because many go unreported.

Where do crypto kidnappings happen?

France, the United States, Brazil and Thailand have the highest cumulative counts since 2023, according to Chainalysis, and France logged 30 publicly known incidents in the first half of 2026 alone. London police identified 17 reported offenses between March and December 2024.