The alarming surge of “wrench attacks” in crypto puts owners on edge

Crypto owners and executives have always had to watch out for hackers, but now face a new and rapidly increasing threat: physical attacks.

The uptick in these targeted attacks has been making headlines, and these incidents are happening globally, from Paris to New York to Buenos Aires.

Data from Galaxy Digital and Casa cofounder and Chief Security Officer Jameson Lopp, who has been monitoring these developments for several years, indicates that there have been at least 25 documented attacks this year.

This would put 2025 “on track to be the most dangerous year ever for crypto owners,” Alex Thorn, Galaxy’s head of firm-wide research, posted. The previous record was set in 2021, with about 36 attacks.

Lopp told Sherwood News that as there’s a rough (lagging) correlation between bitcoin’s exchange rate and the rate of physical attacks, he’s not surprised that this year is on track for an all-time high.

“I predicted last year that we’d see at least an average of one per week in 2025. And that’s just the publicized attacks. There’s good reason to believe that only 10% to 30% of actual attacks end up being publicized,” he said.

To put this in context, in 2015, there were five attacks documented, the data shows.

“This is one of the most harrowing things I have seen in my time, both as a prosecutor and at TRM Labs. We are seeing a brutal convergence of the speed of cybercrime with the violence of street crime,” Ari Redbord, global head of policy and government affairs at TRM Labs, told Sherwood.

Redbord added that as crypto becomes more valuable and self-custody of those assets grows, the threat is no longer just digital; it’s also physical.

“Criminals are adapting fast, shifting from phishing emails to physical force,” he said. “In this world, the human has become the attack surface, and crypto security now means personal security.”

The so-called “wrench attacks,” where physical force or intimidation is used to compel a victim to surrender access to their cryptocurrency holdings, per TRM Labs, are also becoming increasingly gruesome and bolder, involving kidnappings and torture.

In recent weeks, John Woeltz, “the crypto king of Kentucky,” was arrested after having sequestered and tortured an Italian tourist in New York in an attempt to get their bitcoin password.

So far this year, a significant number of these “wrench” attacks have occurred in France, Galaxy data shows.

Paris specifically has been struggling with a string of crypto attacks in recent months. In May, the pregnant daughter of crypto exec Pierre Noizat, CEO of Paymium, and her toddler were almost snatched in broad daylight. In two different disturbing incidents, a family member and a crypto exec were abducted and had fingers severed.

Ogle, the pseudonymous cofounder of the blockchain ecosystem Glue and a cybersecurity adviser to WLFI, has been extremely vocal about these threats for years.  

“I’ve never understood how people with meaningful amounts of crypto wealth don’t take basic precautionary measures such as having personal security, not telling people where they live unless they’re very trusted, etc. It’s some of the most cost-effective life and wealth insurance you can buy,” he told Sherwood. 

He added that the difficulty is that even folks in the crypto industry don’t quite consider cryptocurrency to be “real money” yet. 

“The purely digital nature of it, I think, has a psychological effect on some people where they don’t have the realization that the worst can happen to you is not just losing your money digitally, but is in fact losing a lot more than that physically. The two worlds are connected now. People need to act accordingly,” he said. 

Ogle told Sherwood only three people have ever been to his secondary residence and zero have ever been “to my primary.”

“No mail goes to either,” he added.

A perfect storm for these attacks

David Carvalho, an ex-systems hacker who has advised NATO on cyberwarfare and is the founder of Naoris Protocol, said the uptick in these attacks was inevitable.

Bitcoin reaching new highs and mainstream adoption of crypto creates perfect conditions for physical attacks, he said.

“The main problem is that cryptocurrency turns every holder into a walking bank vault. And being your own bank means accepting that you can be robbed like one,” he said. “Unlike traditional wealth protected by institutional infrastructure, crypto can be instantly transferred under duress.”

Interestingly, he added that the seemingly cryptographically perfect systems fail completely when someone puts a gun to your head. Until wallet infrastructure includes duress codes and emergency protocols as standard, this will only get worse.

How people can protect themselves

Carvalho said that the number one rule is: shut up about your wealth.

“Stop posting portfolios and conference photos,” he said. In addition, consider geographic key distribution, such as multi-signature security across trusted parties in different locations.

And finally: accept you’re a target.

“Bank-level wealth requires bank-level security thinking,” he added.     

Another issue is that once an attack method proves successful and repeatable, it tends to spread quickly, and 2025 has already been a devastating year for many crypto holders, Walter Gaya, executive and dignitary protection consultant at International Security Consulting Group, told Sherwood.

Gaya said that while these types of assaults carry higher personal risk for the attacker, the potential payoff is enormous.

He echoed Carvalho’s sentiment, saying that the opportunity often stems from the victim’s lack of discretion. Crypto “has a certain cool factor” and people want to brag about it, potentially making themselves targets, “particularly if they are posting about their wealth and travel plans on social media,” he added.

“Many victims are selected simply because they’ve mentioned their holdings, posted about them online, or worn crypto-branded gear in public,” Gaya said.

His tips for crypto owners? In addition to being discreet, he recommends completing high-value trades in vetted, surveilled environments, ideally with a second person or trusted security contact aware of the meeting.