The Rise of Wrench Attacks and Crypto-related Violent Crime

In recent months, a disturbing trend has emerged: the physical targeting of individuals associated with cryptocurrency wealth. These so-called "wrench attacks" — named after the hypothetical scenario where an assailant uses a wrench to coerce someone into revealing their crypto keys — have escalated in both frequency and severity, and they’re happening all over the world. 

Unlike cyberattacks, these assaults exploit the vulnerabilities of human behavior and physical security, bypassing even the most robust digital safeguards. Whether a street robbery, a burglary, or a kidnap, these offences share a distinct commonality: high levels of violence that are extremely traumatic for the victims to endure. 

What is a wrench attack?

A "wrench attack" refers to a situation where physical force or intimidation is used to compel a victim to surrender access to their cryptocurrency holdings. The term originates from a webcomic illustrating that, regardless of sophisticated encryption, an attacker could simply threaten someone with a wrench to obtain their password. In the crypto context, this translates to criminals bypassing digital security by targeting individuals directly, often through physical violence or threats of violence. 

Recent prominent wrench attack incidents in France

Attempted kidnapping of a crypto CEO’s family in Paris

On May 13, 2025, the daughter and grandson of a prominent cryptocurrency CEO were attacked in broad daylight in Paris' 11th arrondissement. Three masked assailants attempted to force the woman and her child into a van at gunpoint. Thankfully, the child's father and bystanders intervened — the gun was dropped and the assailants were forced to retreat. The incident underscores the boldness of such attacks and the vulnerability of crypto-affiliated individuals and their families. 

Kidnapping of a crypto entrepreneur's father

Earlier in May, the father of a crypto entrepreneur was abducted in Paris. The kidnappers demanded a ransom between EUR 5 million and EUR 7 million, severing one of the victim's fingers to pressure compliance. French police rescued the victim after 58 hours, arresting five suspects. 

Abduction of Ledger co-founder

In January 2025, David Balland — co-founder of the crypto wallet company Ledger — and his partner were kidnapped from their home in central France. The attackers demanded a EUR 10 million ransom, severing one of Balland's fingers as leverage. Both victims were rescued, and several suspects were arrested. 

Beyond France: The growing global global threat of wrench attacks

Wrench attacks are far from a uniquely French phenomenon. In recent months, similar cases have been reported across the globe — highlighting a disturbing growing global threat.

Recent wrench attacks and enforcement actions in the United States

DOJ uses organized crime statute in cryptocurrency theft, money laundering, and home invasion conspiracy

Just last week, the US Department of Justice and the US Attorney’s Office for the District of Columbia unsealed a sweeping four-count superseding indictment charging 12 additional individuals — both American citizens and foreign nationals — in connection with a racketeering conspiracy involving over USD 263 million in stolen cryptocurrency. In addition to wire fraud, money laundering and racketeering charges, the co-conspirators are charged with activity related to a home invasion.

In July 2024, Marlon Ferro, a member of the criminal enterprise, allegedly traveled to New Mexico to break into a victim’s home in order to steal a hardware virtual currency wallet. The burglary was coordinated in real time with Malone Lam, who is accused of remotely monitoring the victim’s physical location by accessing the victim’s iCloud account. Ferro unlawfully entered the residence and stole the device containing cryptocurrency. This incident was part of a broader scheme in which members of the enterprise tracked and surveilled individuals identified as holding significant crypto assets, then targeted them for physical theft. 

Crypto home invasion ringleader St. Felix sentenced to 47 years

In what is perhaps the best example of the intersection of on-chain money laundering and violent crime, in September 2024, a New York judge sentenced Gilbert St. Felix to 47 years in prison — the longest sentence ever handed down in a US case involving cryptocurrencies — after he was convicted of leading a violent home-invasion ring that targeted crypto holders. 

St. Felix orchestrated a series of armed robberies across multiple states, using brutal tactics to force victims to hand over access to digital wallets. The investigation, aided by blockchain analysis and cooperation from platforms like Coinbase, ultimately tied St. Felix to on-chain activity linked to the stolen funds. The case marks a major milestone in crypto-related prosecutions and highlights how law enforcement is increasingly leveraging blockchain intelligence to bring violent actors to justice. For in-depth reporting on the St. Felix case read TRM’s deep dive here, and our case study with Coinbase’ Global Intelligence team here.

Recent wrench attacks and enforcement actions in the United Kingdom

In the UK, wrench attacks date back to 2018. In one of the UK's first reported crypto-related home invasions, four armed men broke into the residence of cryptocurrency trader Danny Aston in Moulsford, Oxfordshire. They tied up his partner and forced Aston at gunpoint to transfer an undisclosed amount of Bitcoin. 

In 2021, a first-year student at Canterbury Christ Church University was held at knifepoint by a group of eight men who invaded his student accommodation. The assailants forced him to transfer GBP 6,000 worth of Bitcoin and his GBP 3,000 student loan. 

And from 2021-2022, a group of teenagers conducted a series of knifepoint robberies across London, coercing victims into handing over their phones and cryptocurrency access. They stole over GBP 115,000 in digital assets and were eventually apprehended after using stolen bank details to order takeaways to their homes.

Cryptocurrency is now firmly in the mainstream, and as a result, our traditional understanding of physical threat and robbery needs to evolve accordingly.

Recent wrench attacks and enforcement actions in Canada

Canada has seen a sharp rise in wrench attacks

In one of the most brazen cases, in 2023, criminals in Richmond, B.C. posed as police officers to enter a victim’s home, stealing approximately CAD 10 million in cryptocurrency. In nearby Burnaby, another home invasion targeted a known crypto investor who was tied up and robbed at gunpoint. In Vancouver, a trader was assaulted outside his residence after reportedly sharing details about his holdings on social media. And in Ontario, a string of extortion cases involved attackers luring victims through dating apps before forcing transfers of crypto under duress. 

These incidents reflect a growing national trend, with law enforcement issuing warnings and urging crypto users to improve personal security and limit exposure of their digital footprint.

These crimes present a significant challenge for law enforcement agencies, as the target demographic — typically high-net-worth individuals, crypto company executives, and prominent digital asset holders — represents a small, dispersed subset of the population. This makes broad-based victim awareness campaigns difficult to execute effectively, as traditional public messaging often fails to reach those at the highest risk.

Why wrench attacks are on the rise

Several factors contribute to the growing prevalence of wrench attacks as an attractive tactic for criminals targeting crypto holders. 

1. The perceived anonymity and irreversibility of cryptocurrency transactions lead criminals to believe that once funds are transferred, they are difficult to trace and virtually impossible to recover. In other words, perpetrators think they have a clean getaway.
2. The public visibility of wealth has amplified risk. Individuals who flaunt their crypto success on social media or in public forums inadvertently draw attention to themselves as lucrative targets.
3. The ease with which personal information can be gathered online — from addresses to family details — has made it simpler than ever for attackers to identify and track potential victims.

“One factor that should not be overlooked when it comes to wrench attacks is that, at its core, it's a natural evolution of criminal behavior,” said Phil Ariss (Director, UK Public Sector Relations at TRM Labs). “Criminal groups already comfortable with using violence to achieve their goals were always likely to migrate to crypto. As long as there’s a viable route to launder or liquidate stolen assets, it makes little difference to the offender whether the target is a high-value watch or a crypto wallet. Cryptocurrency is now firmly in the mainstream, and as a result, our traditional understanding of physical threat and robbery needs to evolve accordingly. ”

What preventative measures can individuals take against wrench attacks?

Ariss explained, “While every case is different, a strong common thread in many wrench attacks is the profiling of victims prior to the offense. Criminals are increasingly using social media to build detailed assessments of potential targets — particularly focusing on indicators of wealth. This is especially true for individuals involved in peer-to-peer crypto trades or those who are overt about their holdings and lifestyle. Platforms like Instagram, TikTok, and other short-form video content apps are frequently exploited for malicious purposes once a likely 'mark' has been identified.”

Mitigating the risk of wrench attacks requires discretion, security, and awareness. Here are a few basic measures individuals can take to protect themselves and their families.

Maintaining privacy

Individuals should begin by maintaining privacy, avoiding the public disclosure of their crypto holdings or any direct association between their personal identity and wallet addresses. This guidance is particularly important for high-net-worth individuals or those with ties to leadership teams of crypto companies.  

Strengthening physical security

Strengthening physical security is equally important. This could involve installing robust home security systems, using secure transport arrangements, or even employing personal security professionals, depending on the threat level.

Utilizing multi-signature wallets

For those holding significant crypto assets, multi-signature wallets offer an added safeguard by requiring multiple approvals before any transaction can be executed. This makes it much harder for coercion alone to succeed.

Educating family members 

As we’ve seen in recent wrench attack incidents, it’s common for bad actors to target crypto holders’ family members are proxies — so it’s critical for these individuals to educate their loved ones about the risks and importance of staying alert to unusual activity or threats. 

The role of blockchain intelligence in tracing stolen assets

Blockchain intelligence platforms like TRM Labs play a pivotal role in tracing the flow of stolen assets — following wrench attacks, scams, or other criminal activities with a crypto nexus. TRM’s advanced blockchain analytics and attribution helps law enforcement and investigators follow the money, identify potential off-ramps or laundering pathways, and support efforts to bring offenders to justice.

{{horizontal-line}}

Wrench attack FAQs

What is a wrench attack, and how is it different from other types of crypto crime?

A wrench attack involves the use of physical force or intimidation to gain access to a victim’s cryptocurrency holdings. Unlike cyber-enabled attacks, which target digital infrastructure, wrench attacks exploit personal and physical vulnerabilities — bypassing even the most secure cryptographic systems. These crimes often take the form of home invasions, kidnappings, or extortion attempts.

Who is most at risk of a wrench attack?

Wrench attacks typically target high-net-worth individuals, crypto company executives, and traders or investors who are publicly associated with large digital asset holdings. Family members of such individuals are also frequently targeted as proxies. Individuals who publicly disclose their holdings or personal details on social media may face elevated risk.

Why are wrench attacks increasing?

Several factors have contributed to the rise:

• The perceived irreversibility and pseudonymity of crypto transactions
• The public visibility of wealth within the crypto space
• The ease of gathering personal data online (e.g. addresses, routines, social connections)
  

These dynamics combine to make crypto holders a more attractive — and more accessible — target for physical crimes.

What are some real-world examples of wrench attacks?

Recent incidents have taken place in France, the United States, the United Kingdom, and Canada. Notable examples include:

• The attempted kidnapping of a crypto CEO’s family in Paris (May 2025)
• The abduction of Ledger co-founder David Balland (January 2025)
• The 47-year sentence of St. Felix, who led a violent crypto home-invasion ring in the US (September 2024)
  

These cases reflect a broader global trend and highlight the evolving risk landscape for crypto-affiliated individuals.

Can stolen cryptocurrency be traced or recovered after a wrench attack?

In many cases, yes. Blockchain intelligence platforms like TRM Labs are designed to trace illicit transactions in real time. Even if funds are moved across multiple wallets or laundering services, TRM’s tools can help law enforcement follow the money, identify off-ramps, and support asset recovery efforts.

What steps can I take to protect myself and my family?

Mitigating risk requires a combination of operational security and personal awareness:

• Avoid publicly linking your identity to wallet addresses
• Refrain from disclosing crypto holdings on social media
• Use physical safeguards like alarm systems, secure storage, and vetted travel arrangements
• Implement multi-signature wallets to prevent unilateral asset access
• Educate family members about risks and red flags
  

What should I do if I believe I’m being targeted?

If you suspect you are being surveilled or threatened:

• Avoid confronting the threat directly
• Document and report suspicious behavior to local authorities
• If you are in the crypto industry, alert your company’s security team
• Consider consulting personal security professionals for a tailored safety assessment