Image: Grok AI
$30M stolen via wrench attacks so far in 2026. The common pattern in every successful one: the victim made their holdings discoverable. Here’s how to reverse that.
Chainalysis dropped the numbers on August 6. More than $30 million extracted in successful violent attacks on crypto holders through mid-2026. Forty-six documented incidents by late June. Home invasions now make up 37% of them. Kidnappings still dominate the rest. France is the clear hotspot with 30 publicly known cases (authorities there have logged over 70). The year is on track to beat 2025’s $58 million record.
www.chainalysis.com/blog/violent-crypto-wrench-attacks-2026
The success rate has actually fallen to about 26%. Attackers are getting less selective and more opportunistic. But when they do succeed, the pattern is consistent.
The victim’s holdings were discoverable.
Not “rich person vibes.” Actual, concrete signals that someone held meaningful crypto and could be forced to move it. Social media posts about gains or portfolios. Conference appearances where people talk about their stack. On-chain activity tied back to a real-world identity. Public tax filings or leaked government databases (the 2024 French tax data breach that sold dossiers with names, addresses, and holdings is the obvious example). Casual comments to construction workers, delivery drivers, or acquaintances. Linked accounts that let an attacker connect a Twitter handle to a known wallet cluster.
Jameson Lopp’s long-running list of physical attacks makes the same point over and over. You can read the full archive here:
It is not complete — plenty of cases never hit the news — but it is the best public record we have. Incidents stretch back to 2014 and keep getting added. The ones that work almost always start with some form of targeting data the victim left exposed.
I wrote about the physical side of this last year, including practical anti-kidnapping measures and duress setups:
That piece still holds. The digital discoverability problem has only gotten worse.
How the Exposure Usually Happens
Most people do not sit down and decide to become a target. They leak the information in pieces:
Posting screenshots, PNL, or “just bought more” updates.Speaking at events under their real name while also being active on-chain.Using the same email, phone, or username across exchanges, socials, and on-chain explorers.Letting KYC data from one service get correlated with public blockchain activity.Telling the wrong person in real life (“yeah, I hold a bit of Bitcoin”).
Once that link exists, the rest is logistics. Attackers do not need zero-days. They need an address, a routine, and the knowledge that the money can be moved under pressure.
How to Reverse the Discoverability
Start with the assumption that anything public can be used against you. Then shrink the attack surface.
Audit what is already out there. Search your real name, old usernames, and known addresses on Google, archive sites, and blockchain explorers. Check data broker sites and old forum posts. If you find clear links between your identity and holdings, treat them as active risk. This is basic counter-OSINT. I keep a non-typical OSINT guide that covers practical techniques for this exact purpose.Stop creating new links. Do not post about your stack. Do not discuss exact amounts or wallet setups in public or semi-public chats. If you speak at events, keep the personal holdings out of it. Use separate identities for public work and private custody. Avoid posting photos that show home exteriors, cars, or locations that can be reverse-searched.Break the on-chain to real-world chain. Use fresh addresses. Avoid reusing the same ones that have been associated with KYC’d accounts or public activity. For larger amounts, geographic separation of keys in a multisig setup is the single most effective technical control. One key at home is not enough if an attacker can force you to sign. Spread them. Make the process of moving funds slow and multi-party by design.Add friction that survives coercion. Timelocks, velocity limits, and multisig with deliberate delays turn a 20-minute home invasion into something that cannot finish before help arrives or the window closes. Most documented wrench attacks resolve in under 24 hours. Attackers do not want to sit on a victim for days. Anything that forces them to wait raises the cost and the chance of failure.Duress options. Hardware wallets with wipe/self-destruct PINs (Trezor has this). Secondary passphrases that open a decoy wallet with a small amount while the real funds stay locked behind a different setup. Some people use Tasker + Android + wearables to trigger silent alerts. Others keep a simple “anti-kidnapping kit” with GPS trackers, personal alarms, and pre-arranged check-in protocols. Details and examples are in the earlier post linked above.Physical layer still matters. Reinforced entry points, cameras that actually notify someone, and a plan for what happens if people show up at the door. High-net-worth setups sometimes include safe rooms or professional response. Most people do not need that level. They need the basics that raise the difficulty enough that opportunistic crews move on.
Interesting edge cases and facts from the data:
Family members are now used as leverage in a growing share of cases (over 40% in France). Protecting only yourself is incomplete.Many attacks start with insider tips or low-skill crews recruited on messaging apps after the target has already been identified.Success rates are dropping, which suggests more noise and less careful targeting. That does not help the people who still get hit.Decoy wallets are controversial. Some providers advise against them because a determined attacker may not stop. Use them only as one layer among several.Lopp’s repo continues to receive new entries almost every week. The trend is not reversing on its own.
Decoy Wallet Strategies
A decoy (or duress) wallet is a secondary setup you can open under pressure while the main funds stay out of reach. The idea is simple: give the attacker something real and believable so the immediate threat ends, then deal with the rest later.
BIP39 passphrase (the “25th word”) Your seed phrase alone opens one wallet. Adding a passphrase creates an entirely different set of addresses. Leave a modest balance on the seed-only wallet. Keep the bulk behind a strong passphrase. When forced to reveal the seed, the attacker sees the small balance and has no technical way to know a passphrase wallet exists.Hardware wallet duress PIN Some devices (Trezor, Blockstream Jade, and others) let you set a second PIN. Correct PIN → real wallet. Duress PIN → decoy wallet with a limited amount, or in some cases a full wipe.Separate physical device A cheap hot wallet or second hardware unit that lives in an obvious place and holds a few thousand dollars. You unlock that one first.
The balance has to look plausible. A few hundred dollars on a wallet that an attacker already believes belongs to a large holder will often make things worse.
Common advice is $1,000–$10,000 (or local equivalent) with some real transaction history so it does not look freshly created. Occasional small transfers and gas fees help. Keep the decoy “alive.” An empty or brand-new looking wallet raises suspicion.
BIP39 Passphrase Implementation
The BIP39 passphrase (often called the “25th word”) is an optional string you supply when deriving the master seed from a mnemonic. It is not part of the 12- or 24-word list itself. Changing even one character produces an entirely different wallet with different addresses and keys. There is no “wrong passphrase” error — every string simply opens a valid, independent wallet.
How the derivation actually works:
Your mnemonic words are converted back to entropy (with checksum validation).That mnemonic string becomes the password input to PBKDF2-HMAC-SHA512.The salt is the fixed string “mnemonic” concatenated with your passphrase (empty string if none is used).After 2,048 iterations the function outputs a 512-bit binary seed.That seed feeds BIP32 hierarchical derivation to generate all private keys and addresses.
Because the passphrase is part of the salt, two passphrases that differ by a single space, capital letter, or character produce completely unrelated wallets. The hardware or software never stores the passphrase; you must re-enter it every time you want the protected wallet.
Under coercion you can reveal the seed words. The attacker recovers the default wallet, sees the decoy amount, and has no cryptographic evidence that another wallet exists. This only works if the decoy balance looks realistic relative to what the attacker already believes about your holdings.
Choosing and Handling the Passphrase
Aim for real entropy. Four to six random BIP39 words (Diceware-style) give roughly 44–66 bits. Six or more is preferred against offline brute-force once an attacker already has the seed.Avoid single dictionary words, birthdays, pet names, or short strings. Capitalization, spaces, and punctuation all matter and must be reproduced exactly.Back it up separately from the seed — different physical location, different medium. Memory alone is not a backup.Test restore with a small amount first. A single typo silently opens an empty wallet.
The Hard Limits
Jameson Lopp and Casa have been clear on this for years: duress wallets are unreliable under real violence.
Attackers who did any reconnaissance may already know the approximate size of the stack.Once they suspect you are lying, the situation can escalate.There is almost no public data showing these strategies consistently end attacks cleanly. One documented case involved the victim handing over a large amount and still being beaten for hours.
A decoy is not a substitute for making the main funds impossible to move quickly. It is at best a temporary de-escalation tool.
Better When Combined With Other Layers
Most experienced operators treat the decoy as one small piece of a larger setup:
Multisig with keys in different physical locations so no single person under duress can authorize a large transfer.Time-locks or velocity limits that force any movement to wait hours or days.Strong privacy so the attacker never knows how much is actually there in the first place.A practiced script (“the rest is in a 2-of-3 with a key at the lawyer’s office and a 48-hour delay”).
If you use a decoy, test the entire flow yourself under calm conditions. Know exactly what you will say and show. Assume the attacker may keep pushing after the first wallet. Decoy wallets buy time and options. They do not make you safe by themselves.
Conclusion
None of this is theoretical. The $30 million figure is only the successful transfers that got reported. Attempted extractions run higher. The common factor remains the same: the victim’s holdings were visible enough to select them.
Make the selection step fail. That is the highest-leverage move available right now!
$30M Stolen Via Wrench Attacks So Far In 2026 was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.