Crypto-currency crime is increasingly moving beyond the digital world, with criminals using home invasions, kidnappings and hostage situations to force crypto holders to surrender their assets.
This is according to blockchain analytics company Chainalysis, in its 2026 Mid-Year Crypto Crime Report, which estimates that more than R495.5 million ($30 million) has already been stolen in successful violent attacks targeting crypto-currency holders this year.
If the current trend continues, Chainalysis says 2026 could become the worst year on record for violent crypto attacks, surpassing the R946 million ($58 million) stolen in 2025.
The attacks, sometimes referred to as “wrench attacks”, target crypto-currency holders because their wealth can be transferred almost instantly and irreversibly, often without the institutional protections associated with traditional financial assets.
Chainalysis says the attacks include home invasions, kidnappings and hostage situations, with criminals increasingly recognising that individuals can hold millions of dollars in crypto-currency accessible through a smartphone or hardware wallet.
“Most crypto-currency crime happens entirely online: hacks ($3.4 billion stolen in 2025), scams ($17 billion), ransomware ($820 million), and more that exploit technical vulnerabilities or human psychology,” the company says.
“But, according to the 2026 Chainalysis Mid-Year Crypto Crime Report, a different category of crypto crime has been accelerating globally: one that involves physical violence.”
Crypto-currency violence
The nature of the attacks is also changing. Chainalysis data shows kidnappings account for the majority of documented wrench attacks, followed by home invasions, hostage-taking and other forms of violent crime.
Home invasions increased from 14% of documented attacks in 2025, to 37% through the middle of 2026, according to the report.
Looking at the longer-term trend, home invasions accounted for 26% of documented incidents in 2023, compared with 39% for kidnappings. By 2026, home invasions had risen to 37%, while kidnappings accounted for 52%.
Chainalysis cautions that the categories can overlap, with some attacks beginning as home invasions before escalating into kidnapping or forced transfers.
The report also identifies a growing threat to the families and associates of crypto holders.
“By early 2026, incidents targeting family members or acquaintances accounted for approximately 25% to 30% of cases, up from near zero in 2021,” Chainalysis says.
It notes that the shift means attackers are increasingly using relatives and other people close to crypto-currency holders as leverage, rather than targeting the holders themselves.
Chainalysis says the attacks are often highly planned, with victims identified through exposed information from data breaches, social media activity or insider knowledge.
However, the company says the people carrying out the physical attacks are increasingly lower-skilled criminals recruited through messaging applications, while more sophisticated actors handle the crypto-currency transactions and laundering.
“The tradecraft tends to be amateur at the point of violence, but professional at both ends,” Chainalysis says.
Blockchain gang
The company identified three broad categories of attackers based on their on-chain behaviour.
The least sophisticated criminals typically transfer stolen crypto-currency directly to centralised exchanges without attempting to conceal the transactions.
Chainalysis says these cases can be easier for investigators to pursue because exchanges can freeze funds and identify recipients through customer information.
More sophisticated attackers use decentralised exchanges, bridges, maximal extractable value bots and other decentralised finance tools to move funds between wallets and blockchains, attempting to avoid centralised exchanges that have stronger compliance and know-your-customer controls, it explains.
According to the firm, the most concerning group consists of attackers apparently embedded in wider criminal networks, with blockchain analysis revealing links to other illicit actors.
Hit rate
Despite the growing number of violent attacks, the proportion resulting in successful payments has declined.
Through late June 2026, Chainalysis notes that only 26% of violent theft attempts – 12 out of 46 – had resulted in payment, compared with 49% in 2025 and 67% in 2024.
However, the value involved in attempted attacks remains substantial. Chainalysis estimates that attempted extractions, including ransoms demanded, transfers that were coerced but blocked and funds subsequently frozen or recovered, amounted to about R5.16 billion ($316 million) in 2024, R2.94 billion ($180 million) in 2025 and R1.75 billion ($107 million) so far in 2026.
The company says these figures are likely an undercount because they cover reported attacks.
It adds that the emergence of violent crypto crime also creates new challenges for law enforcement, but the transparency of blockchain transactions can provide investigators with evidence once funds have been transferred.
“When violent attacks succeed, the stolen crypto must be moved and eventually cashed out,” Chainalysis says.
The company argues that collaboration between investigators dealing with physical crimes and blockchain analysts can help identify laundering patterns, connect separate cases and potentially identify organised criminal groups.
For crypto-currency holders, Chainalysis says the findings highlight the importance of operational security, including limiting public disclosure of crypto-currency holdings and avoiding the linking of identifiable personal information to on-chain activity.
The report also warns that sensitive personal information collected through regulatory frameworks needs to be adequately protected, as such data can potentially be used by criminals to identify wealthy crypto-currency holders.
Chainalysis says the rise in violent attacks demonstrates that crypto-currency is no longer solely a cyber crime issue.
“Crypto-currency now intersects with all categories of criminal activity, not just cyber crime,” the company says.
“This means blockchain literacy should not be limited to specialised units.”
Share
