Crypto wrench attacks: how what you post picks the victim, and what creators can film instead

A record $58 million was taken in violent crypto robberies in 2025, and London police traced almost half of the cases they could analyze to something the victim had made public. What a wrench attack is, how targets get chosen, and what a creator can put on screen without a real wallet.

Published: 14 October 2026 · Last reviewed: 1 November 2026

Hardware wallet app screen composed in Flexdger Wallet: a portfolio named Halcyon, a total balance and its change for the day above a row of Transfer, Swap and Buy buttons, a market row and a perpetuals card, then the list of holdings with each amount and its move for the day, in a dark theme with a lavender accent. — Composed in Flexdger Wallet. Every figure on it was typed in; nothing is held, sent or received, and no chain is read.

A townhouse in SoHo, and a password

In New York in 2025, two men were indicted on counts including kidnapping, assault and coercion. The allegation: a man was held for 17 days in a SoHo townhouse while his captors pressed him for his bitcoin password. Both defendants pleaded not guilty. The case is useful as an illustration because it contains the whole mechanism of this crime. The valuable thing was not in the building, it was in the victim's head, and the people who knew he had it were willing to hurt him to get it.

Security researchers call this a wrench attack. The definition used by Chainalysis is a physical attack in which someone uses violence, or the threat of violence, to force a crypto holder to hand over assets, for instance by making them unlock a wallet or send a transfer under duress. Home invasions, kidnappings and hostage situations are the usual forms.

Where the name comes from, and why crypto suits it

The label comes from a 2009 xkcd comic called "Security". Two villains give up on cracking an encrypted laptop and decide to hit its owner with a $5 wrench until he gives up the password. The strip is a threat model in four panels: the strongest encryption does nothing against a person who can be coerced.

Crypto gives the coercion a payoff. Chainalysis notes that holders keep wealth in a form that moves instantly and irreversibly, often in self-custody with no institution in the way. A 2026 framework written by London's Metropolitan Police and TRM Labs puts it in one image: with self-custody, there is no teller or branch manager at the point of coercion.

What the counts say

Chainalysis, the blockchain analytics firm, follows publicly known incidents worldwide. Its August 2026 report gives three snapshots.

2024: 48 violent theft attempts, of which 32 (67%) ended in payment. The report puts the amount below the 2025 record, and about $316 million once attempted extractions are counted.
2025: 95 attempts, 47 (49%) ending in payment, and $58 million stolen, the record. Counting attempted extractions, about $180 million.
2026, through late June: 46 attempts, 12 (26%) paid, more than $30 million stolen, and about $107 million with attempts included.

The shape of the incidents has moved. Kidnappings made up 52% of 2026 incidents, and home invasions 37%, up from 26% in 2023. Attacks aimed at a holder's relatives or acquaintances reached about 25 to 30% of cases by early 2026, and above 40% in France. Victims were mostly local residents (93% in France, 77% in the United States), which Chainalysis reads as evidence of reconnaissance and planning.

A different method gives a different count with the same direction. Open-source research cited by TRM Labs found about 18 attacks in 2023, 24 in 2024 and roughly 70 in 2025. Each source adds that the real figure is higher, because many cases are logged as ordinary robberies or are never reported. Chainalysis also stresses that violent crypto attacks "remain rare events in absolute terms". The takeaway is not that every holder is in danger. It is that the people who are targeted are rarely chosen at random.

Three countries, three pictures

According to Chainalysis, France, the United States, Brazil and Thailand had the highest cumulative counts since 2023, as of November 1, 2026 and from the sources linked below.

France: 30 publicly known incidents in the first half of 2026 alone. In late June, interior minister Laurent Nuñez said authorities had documented more than 70 crypto-related violent incidents. Chainalysis reports an alleged 2024 leak in which a tax official is accused of stealing and selling files on wealthy crypto holders (names, addresses, holdings), and counts about 200 arrests by mid-2026.
United Kingdom: the Metropolitan Police identified 17 reported wrench attack offenses in London between March and December 2024. Kidnap was the most common type, at 59% of cases, and the average crypto loss was about £660,000 per offense.
United States: the SoHo case above is one example, and it is a reminder that the crime is not confined to one country.

Four ways a victim comes to an attacker's attention

The Metropolitan Police reviewed how the victims in its cases first came to the attention of offenders. It found four pathways, and the first one is a choice the victim made.

Voluntary exposure, 47% of identified cases. Public posts about holdings, trading activity, an influencer profile, or a visible link to a crypto business.
Community exposure. Crypto events, trading forums and messaging channels that put wealthy holders in one place.
Involuntary exposure. Data breaches, SIM swapping or stolen devices that reveal holdings.
Associational exposure. A relative or associate approached as a route to the holder.

Because the largest pathway is the one creators control, content itself is the exposure. In 2025 TRM Labs said criminals increasingly use social media to build assessments of potential targets, looking for signs of wealth, and that Instagram, TikTok and other short-form video apps are "frequently exploited" once a likely mark has been identified. The 2026 framework describes a June 2024 London case in which a cryptocurrency influencer had $4.3 million in digital assets stolen at knifepoint during a burglary.

A wallet total works as a price tag, and so does everything around it: the room, the view from the window, the car, the city in the bio, the gym you check in at every morning, the same handle on every platform. Kaspersky's guide to doxing notes that a username reused across services lets someone assemble a picture of how a person spends their time.

An audit to run before every upload

Every report cited here opens with the same advice. Chainalysis: avoid publicly disclosing holdings, whether through social media, conference appearances or on-chain activity linked to a known identity. TRM Labs: do not disclose crypto holdings on social media, and avoid publicly linking your identity to wallet addresses. Turned into a production checklist, it becomes seven questions to ask of a finished video.

Does it show a real balance, purchase or dollar gain? That is the wealth indicator every report names first (what one gains screenshot gives away). Use percentages on a hypothetical, or a labeled simulated wallet.
Is an address, QR code or transaction ID visible, even briefly? It ties your on-chain history to your face (what viewers read from a stream). Keep it off camera entirely, shortened or not.
Can anyone identify the street, entrance, window view or mail? Home invasions were 37% of 2026 incidents. Film in a neutral room and check every background.
Does it reveal where you are right now? Real-time location is what an attack gets planned around. Post after you leave, and strip location data from photos.
Is a family member in it, especially a child? A quarter or more of cases go after a relation, so keep them out of crypto content altogether.
Does it invite followers to meet or trade in person? The Met describes victims lured to a location by people posing as buyers. Do not trade face to face with people you met online.
Is it the same handle as your real identity? One name everywhere lets anyone stitch your accounts together. Separate the creator and personal identities (the four leaks that unmask a faceless channel).

Two of these have a plain setting behind them. Apple's personal safety guide warns that people you share photos and videos with "may be able to access the location metadata and learn where it was taken", and explains how to switch location off before sharing. Twitch recommends a stream delay on in-person streams, so viewers cannot tell exactly where you are in real time.

When the holdings are large

Content discipline lowers the chance of being picked. For people with significant funds, the security firms add measures designed to hold up under pressure.

Custody that threats alone cannot open. TRM Labs recommends multi-signature wallets, which need several approvals before funds move. Chainalysis speaks of secure custody arrangements.
Physical security in proportion. Anything from an alarm system to professional protection, depending on the threat.
A talk with the family. Relatives get targeted as proxies, so TRM Labs advises explaining the risks and asking them to watch for unusual activity.
Less personal data, in fewer places. Leaks have fed attacks: Chainalysis ties the French wave to stolen tax dossiers, and the London framework cites a 2020 breach of a hardware wallet maker's customer list, home addresses included, as an upstream factor in later cases.
If you suspect surveillance, TRM Labs says not to confront anyone, to document what you see and report it to local police, and to consider a professional security assessment.

Putting a wallet on screen without putting yours there

Some video formats really do need a wallet in the shot: a reaction to a pump, an explainer on what a portfolio looks like, a skit about buying the top (how to make crypto TikToks says which ones, and what never to show). Filmed from your actual wallet, each one fails the first two questions of the audit above.

A larp wallet, also called a crypto wallet app simulator, closes that gap. It draws a believable wallet screen from balances you type in, for videos, skits, pitch decks and demos, and it holds no funds and reads no blockchain. No address of yours appears on the screen, because there is none to show. Flexdger Wallet is one such app (the larp wallet guide explains the term).

What a simulated screen does not fix

It removes the exposure, not the impression. Viewers cannot tell a typed balance from a real one, so a screen that shows a fortune can paint a target on you just as a real one would. Keep the figures modest and visibly illustrative, keep a "Mockup" label in the frame, and say in the caption that the wallet is simulated.

And never present it as your holdings or your results. A mockup is a prop, never proof of anything, and passing it off as real is deception, which our terms of use forbid. For how wealth gets staged online, and why audiences should doubt every screen, read larping rich, prop by prop.

Sources

Questions

Where does the "$5 wrench" come from?

From a 2009 xkcd strip titled Security. Two villains abandon the idea of breaking a laptop's encryption and plan to hit its owner with a $5 wrench until he talks. The joke is a threat model: the best cryptography is useless against someone who can be pressured.

Is a crypto kidnapping a different thing from a wrench attack?

A kidnapping is one kind of wrench attack, next to home invasions and hostage situations. Among the 46 incidents Chainalysis recorded through late June 2026, kidnappings were 52% and home invasions 37%.

Are crypto influencers likelier to be targeted?

Being visible is the risk. In the Metropolitan Police review of London cases, voluntary exposure, which covers public posts about holdings and influencer profiles, was behind 47% of identified cases. TRM Labs adds that short-form video apps are frequently exploited once a likely target is spotted.

How can I lower my risk as a creator?

Keep real holdings, gains and wallet addresses off social media, and do not tie your identity to an address. Leave your home, live location and family out of crypto content. Larger holders add custody that needs several approvals, physical security suited to the threat, and a conversation with relatives.

Are these attacks widespread?

Chainalysis says violent crypto attacks remain rare events in absolute terms, and also that the true count is higher because many go unreported. The point is less that everyone is at risk than that victims are seldom picked at random.

Which sources define a wrench attack?

Chainalysis describes it as an attack in which someone uses violence, or the threat of it, to force a holder to hand over assets, for example by making them unlock a wallet or send a transfer under duress. Home invasions, kidnappings and hostage situations are its usual forms.