Europe has yet again landed in trouble with latest reports claiming that the region has emerged as the core center for crypto wrench attacks.
Estimated losses from crypto “wrench attacks” reached roughly $101 million during the first four months of 2026, nearly doubling the total recorded for all of last year, according to new research from CertiK.
The security firm stated on Friday that just 34 reported cases of such attacks had taken place during the year, but the losses caused by the criminals were already higher than the $52.2 million that was reported in the total number of 2025.
Strangely enough, most of the attacks took place in Europe, making up nearly 82 percent of the total number of cases.
Unlike crypto hacking attacks, wrench attacks do not use malware and any other technical means to steal victims’ crypto coins; instead, they employ physical force or intimidation tactics to make victims reveal their wallet access codes or private keys.
Europe sees major shift in crypto crime pattern
According to CertiK, the concentration of attacks in Europe marks a major geographic shift in crypto-related crime.
“Our 2025 report documented a gradual tilt from Asia and North America toward Europe, and these first four months of 2026 mark a European hyper-concentration,” the company said.
If the trend is maintained, CertiK predicts that attacks will be in the vicinity of 130 by year-end, while total losses may amount to hundreds of millions of dollars.
More than any other EU member country, France has become the focal point of these assaults. In 2026, CertiK logged a total of 24 crypto wrench instances from France, but the French National Prosecutor’s Office of Organized Crime claims that there are many more cases, which puts the total at around 47.
There are many reasons why experts think that France is becoming more vulnerable. There are many important cryptocurrency companies based in France, including Ledger, Paymium, and Binance. Additionally, the nation is the home ground for many important cryptocurrency entrepreneurs and investors.
On the other hand, a string of data hacks and breaches seem to have helped crypto holders become more identifiable and vulnerable to such attacks.
According to Certik, this includes the recent hack at Waltio, a cryptocurrency accounting firm, as well as claims that French tax officials were selling off data about crypto asset owners to crime syndicates.
Public wealth display in crypto community raises exposure risks
The report also highlighted what it described as a continuing “culture of flexing and voluntary doxxing” within parts of the crypto community, where users publicly display wealth or unintentionally expose personal details online.
According to CertiK, attacks are becoming increasingly data-driven. Criminal groups no longer need extensive physical surveillance once they gain access to detailed personal information such as home addresses, financial profiles, or phone numbers.
“Early 2026 marks the shift to a data-driven targeting model in which prior physical surveillance becomes unnecessary once attackers have the victim’s full name, home address, financial profile, and so on,” the company said.
“The structural takeaway is clear: as the security of protocols and wallets tends to improve, the threat migrates toward the human link,” CertiK added.
Blockchain intelligence firm TRM Labs has previously warned that wrench attacks are becoming more common because crypto wealth is often publicly visible onchain while many users continue to leave personal information exposed online.
CertiK in its report added that the criminal groups carrying out these attacks are often surprisingly disorganized. The masterminds behind operations are frequently located in different countries, while the individuals carrying out attacks on the ground are commonly recruited through messaging apps such as Telegram or Snapchat.
“These people often don’t know each other and are complete amateurs,” CertiK said, adding that many are recruited for only a few thousand dollars.
Usually, perpetrators disguise themselves as couriers or policemen or even trick victims to come under a trap in the guise of business meetings and investments.
At the same time, Jameson Lopp, who personally monitors cases involving wrench attacks around the world, has identified 31 crypto crimes till now in 2018. Additionally, in March, he mentioned that some of the crimes were carried out based on identity confusion.
French authorities have already intensified enforcement efforts. In April, at least 88 people, including 10 minors, were indicted in connection with alleged wrench attacks targeting crypto holders.
As crypto ownership becomes more mainstream and digital wallets hold increasing amounts of wealth, security experts warn that physical safety is now becoming just as important as cybersecurity for many investors.