Rise in wrench attacks tied to foreign networks: French police

Getting your Trinity Audio player ready...

French police have said the recent rise in crypto-related extortion kidnappings, also known as “wrench attacks,” is no longer isolated incidents but rather a phenomenon that criminal networks have exploited.

In a confidential memo dated January 15, 2026, France’s Strategic Information, Intelligence, and Analysis Service on Organized Crime (SIRASCO), the country’s organized crime police agency, expressed concern about a sharp increase in digital asset-related ransomware attacks since 2023.

Between July 1, 2023, and December 31, 2025, around 40 incidents of kidnapping and hostage-taking targeting cryptocurrency holders were recorded in France. According to the SIRASCO memo, which was reviewed by local outlet Le Parisien, these incidents were mostly “in urban areas, and more specifically in the Paris region.”

Most of these cases, more than 20, reportedly involved crypto-asset holders and professionals being targeted, with victims often being relatively young men, aged between 20 and 35, who make up a larger portion of the crypto-world demographic.

According to the police, these victims are often spotted by their attackers on social media, such as on TikTok, YouTube, or Instagram, due to a propensity to flaunt their luxurious lifestyle and quick, crypto-gained wealth. Criminals learn more about the victims and their relatives via these posts and videos, which help the perpetrators plan attacks, kidnappings, and abductions.

However, SIRASCO said that some of the cases also involved “individuals targeted, with no connection to this sector, and forced to repay a debt through a transfer of crypto-assets.”

In terms of the criminals, the confidential memo reportedly explained that the lead perpetrators are often established abroad, from where they coordinate the kidnappings and direct the French recruiters.

This latter group, the “middlemen,” is then responsible for hiring the individuals who carry out the kidnapping and extortion. These are, by and large, young people under 30. According to SIRASCO, these young adults are often already known to the authorities for acts of theft, violence, or drug trafficking, with wrench attacks being the latest addition to their criminal resumes.

When it comes to digital asset sector crime, the major concerns of authorities and consumers alike have traditionally been fraud, Ponzi schemes, rug pulls, hacks, and money laundering. However, with wrench attacks on the rise, crypto investors now face an arguably scarier prospect.

Wrench attacks

According to CertiK’s “Skynet Wrench Attacks Report,” published on February 3, there were 72 verified physical coercion incidents worldwide in 2025, a 75% increase compared to 2024.

“Kidnapping remains the primary attack vector, while physical assaults rose by 250% year-on-year, highlighting clear escalation in brutality,” read the report.

Europe accounted for 40% of global incidents, with France the worst-affected jurisdiction.

“In 2025, France is the country with the highest number of incidents in the world with 19 attacks, far ahead of the USA with 8 recorded incidents,” read the report.

The most notable case involved the January 1 abduction of David Balland and his wife from their residence in Méreau, central France. The attackers demanded a 10 million euros ransom paid from his business partner in cryptocurrency. Eventually, the pair were rescued and some of the attackers brought to justice, which revealed “a sophisticated network operating out of Morocco.”

Based on CertiK’s research, total “confirmed” financial losses due to wrench attacks in 2025 exceeded $40.9 million, up 44% from 2024. However, the firm said that this figure “significantly understates the true impact” due to the under-reporting of incidents, silent settlements, and untraceable ransoms.

“2025 confirmed that wrench attacks have become a distinct category of incident within the ecosystem,” concluded the report, adding that “the industry faces a true humanitarian crisis.”

Watch | Combatting threats in digital banking: WFIS 2025 Philippines Highlights