Crypto and Physical Safety: How Not to Become a Target
Rick finds a letter with his own home address and a demand to pay in bitcoin. How did they know? A leaked wallet-shop buyer list gave away who he is and where he lives; his own profit screenshot did the rest. Why a decoy wallet is a trap, what to do if you are threatened, and how a withdrawal delay and a 2-of-3 multisig mean no single person can hand over everything. CertiK counted 52 confirmed attacks worldwide in the first half of 2026.
Some criminals no longer break into crypto wallets. They threaten people and their families. In this lesson you will see what the latest numbers show and why different sources count differently, the four channels criminals use to find victims, how to rate your own protection with a checklist, and why multisig and withdrawal delays protect better than a decoy wallet. The core idea is one: tell nobody how much crypto you hold, or whether you hold any at all.
Wrench attackWrench attackA physical attack on a crypto holder: threats, kidnapping or a home invasion so that the victim transfers the crypto themselves. Instead of hacking the wallet, the attacker pressures the person.Read the lesson → is a physical attack on a crypto holder: threats, kidnapping, or a home invasion so that the victim transfers the crypto themselves. Instead of breaking the encryption, criminals pressure the person.
This lesson continues lesson 2-1 on wallet security. There we learned how to protect keys from hackers and scammers. Here we cover the other side: how to stay off the target list, and what to do so that even under attack you could not hand over everything at once on your own.
1. What is happening: facts from three sources
The number of physical attacks on crypto holders is growing in 2026, and most cases are recorded in Europe, especially France. But one note before the numbers: the three main sources count different things, so their figures must not be mixed.
| Source | What it counts | H1 2026 (first half) | Comparison |
|---|---|---|---|
| CertiK (security firm) | Confirmed incidents and the value recorded in connection with them | 52 incidents; $124.1M in related value | H1 2025: 39 incidents; $10.5M |
| Chainalysis (blockchain analytics) | Documented violent incidents and the amount actually stolen | 46 incidents; more than $30M stolen | All of 2025: $58M stolen (a record) |
| French Interior Minister L. Nuñez | Crypto-related kidnappings, unlawful confinement, extortion, or attempts at them, in France | 77 cases (as of June 30) | All of 2025: 45 cases |
CertiK's $124.1M is not the amount stolen. It is the value that was connected to incidents, including what criminals demanded or tried to obtain. The amount actually stolen is counted by Chainalysis.
More CertiK details for H1 2026:
- 39 of the 52 incidents (75%) happened in Europe, 33 of them in France.
- There were 20 home invasions (1 a year earlier) and 16 kidnappings (12 a year earlier).
- For all of 2025, CertiK confirmed 72 incidents, 75% more than in 2024.
All three sources see only what became known. Some victims do not go to the police, and some cases are filed as ordinary robbery or extortion with no note that crypto was involved. So the exact number is unknown, but the direction is the same in every source.
Case: the Ledger co-founder (January 2025)
On January 21, 2025, David Balland, co-founder of the wallet maker Ledger, and his partner were kidnapped from their home in France. The kidnappers demanded a ransom of about €10 million in cryptocurrency and, to press the demand, injured him: they cut off a finger. The French gendarmerie's special unit GIGN freed him the following evening, and his partner was found on January 23. The ransom was partly paid in the stablecoin USDTUSDTTether USD stablecoin. An alternative to USDC. Liquidity on Solana has historically been smaller — most Solana DeFi liquidity is still in USDC.Read the lesson →, but most of the funds were frozen and confiscated.
Ten people were detained, seven were charged and arrested, and five of them face 20 to 25 years. There is no court verdict yet.
Other trends
- Posing as police. In France, three men posing as police officers forced a couple to transfer bitcoin worth about €900,000.
- Young perpetrators. France's organized-crime prosecutor (PNACO) is investigating 95 suspects, 13 of them minors. Criminal networks recruit young people through social media.
- The state's response. According to Interior Minister L. Nuñez, about 200 people have been detained in France, and 724 crypto-sector professionals have signed up to a special rapid-identification platform.
- Our region. In 2024, an attempt was made in Tallinn to kidnap the crypto billionaire Tim Heath (the attackers posed as painters; a case against two men was heard in court in 2025). In Latvia, a Riga resident was detained who had planned two kidnappings to extract wallet passwords.
2. How criminals find victims
Most victims were not random. A criminal has to combine three things: who you are, where you live, and whether you hold crypto. These pieces most often come from leaked data or from people themselves.
| Channel | Real example | What the criminal gets |
|---|---|---|
| A seller's database leak | Ledger e-shop (2020): about 272,000 names, addresses and phone numbers and more than 1 million email addresses were published online. People later received threatening letters with their home address | Who owns a crypto wallet and where they live |
| Bribed employees | Coinbase (2025): overseas customer-support contractors were bribed; the names, addresses, phone numbers, ID photos and balance data of 69,461 customers leaked | Address and how much they hold |
| Government and service databases | France: a former tax-authority (DGFiP) employee was arrested, suspected of selling people's names, addresses and declared crypto holdings to criminals; a leak at the crypto tax platform Waltio (about 50,000 users) | A reliable target list |
| The person themselves | Bragging on social media, screenshots of profits, chats, sudden expensive purchases | Confirmation that it is worth attacking |
Takeaway: even if you tell nobody, your data may already have leaked from a shop, an exchange, or another institution. A leak cannot be undone, so two directions matter: staying quiet, and reducing the places where your real address sits next to the fact that you hold crypto.
3. Security rules
The best protection is that nobody knows. The second best: that even under attack you could not quickly hand over everything on your own.
Silence and data
- Tell nobody how much crypto you hold, or whether you hold any: not friends, not colleagues, not on social media.
- Do not post screenshots of balances, profits, or wallet addresses.
- Do not use your home address when buying wallets and equipment: choose a parcel locker or your work address.
- Keep a separate email address for exchanges that you use nowhere else.
- Check whether your email has leaked, for example on the free site haveibeenpwned.com.
Technical protection against coercion
- MultisigMultisigA multi-signature wallet — a transaction requires approval from multiple people.Read the lesson → (multi-signature wallet): a transfer needs, for example, 2 keys out of 3, kept in different places or by different people. An attacked person physically cannot move everything alone. MPC (multi-party computation)MPC (multi-party computation)The private key never exists in one place; signing needs several parts to agree. Like multisig, one person cannot sign alone.Read the lesson → achieves a similar goal: the key is split into parts, and a signature needs several of them.
- Withdrawal delay (timelock)Withdrawal delay (timelock)A setting where a withdrawal only executes after a set time (e.g. 24–72 hours). Gives time to notice and stop a transfer started under duress or by a scammer.Read the lesson → and limits: if your exchange offers it, set withdrawals to execute only after 24 to 72 hours, and turn on a daily limit and a whitelist of allowed addresses.
- Most of it away from home: do not keep seed phrases and devices where you live. How to write down and store a seed phrase safely is covered in lesson 2-1.
- Decoy walletDecoy walletA separate wallet with a small amount that can be handed over to an attacker. Works only together with multisig or a delay: if the attacker knows the real amount, a decoy can make things more dangerous.Read the lesson →: a separate wallet with a small amount, or a hidden wallet with an extra passphrase. This is only an add-on, not the main protection.
The security firm CertiK recommends the same logic: multisig or MPC with geographically separated signers, withdrawal delays, amount limits, and allowlists, so that one threatened person cannot hand over everything at once.
A decoy can help against a random robber, but it is not reliable protection. If criminals know from leaked data how much you hold, a small amount will anger them and the danger only grows. So a decoy works only together with multisig or a delay. Then you can tell the truth: "I can't transfer everything, even if I wanted to."
Your life matters more than any asset. If you are threatened, do not resist, hand over what you can, and contact the police as soon as possible.
Your checklist
TickTickThe smallest price step in concentrated-liquidity protocols (Uniswap V3, Orca).Read the lesson → what you already do. Whatever is left unticked is your to-do list.
Tick what you already do. Your ticks are saved only in your browser and sent nowhere.
Your life matters more than any asset. If armed attackers threaten you, do not resist and do not negotiate: hand over what you can and call 112 (the EU emergency number) as soon as possible.
This is learning, not investing — use only small amounts you treat as tuition.
4. Scenario: what happens during an attack
Pick a protection level and see what an attacker can get right away. Turn on the switch when the attacker knows your real amount: you will see why a decoy does not work on its own.
What happens during an attack?
Pick a protection level and see what an attacker can get right away.
There is no way to say “I can’t”: everything is reachable in minutes with one action of yours.
An illustration, not security advice. Your life matters more than any asset: if threatened, do not resist and contact the police as soon as you can (112 in the EU).
The point is simple: the less you alone can hand over, and the less right away, the less point there is in pressuring you.
5. If you are threatened
Immediate danger: call 112 (the EU emergency number)
Do not negotiate or resist armed attackers. Hand over what you can. Assets can be recovered, health and life cannot.
A threatening letter or message
Do not pay. Save the evidence: screenshots, email headers, the envelope, phone numbers. Report it to the police.
A caller claims to be from the exchange or the police
Hang up and call back yourself on the official number from the institution website. A real institution never asks for a seed phrase or a transfer to a safe wallet.
The transfer already happened
Report it to the police and the exchange immediately. In the case of the Ledger co-founder, most of the ransom funds were frozen. The sooner you report, the better the chances.
Afterwards
Change your passwords. Treat every key revealed to the attackers as compromised: move the remaining assets to new wallets with new seed phrases, ideally with several signatures.
- Multisig risk. If you lose more keys than the scheme allows (for example, 2 of 3), you lose access too. A multi-key scheme needs order and clear instructions.
- The cost of a delay. A withdrawal delay also protects against yourself: if you urgently need money, you will have to wait.
- Decoy risk. If the attacker knows the real amount, a decoy can increase the danger.
- Leaks are irreversible. Data that has already leaked can be used years later. That is why it matters not to create new links between your name, your address and your crypto.
6. Self-check
Now you know how criminals find victims, and you have a clear plan for becoming invisible, and for not being able to hand over everything at once even under pressure.
Summary
- Physical attacks on crypto holders are growing, mostly in Europe. Quote every number with its source: CertiK, Chainalysis, and the French ministry count different things.
- Victims are most often chosen from leaked data and bragging that link identity, address and wealth.
- The key rule: tell nobody how much crypto you hold, or whether you hold any, and reduce the places where your real address is left.
- MultisigMultisigA multi-signature wallet — a transaction requires approval from multiple people.Read the lesson →, MPC, withdrawal delays and limits make it impossible for one person to hand over everything at once. A decoy is only an add-on.
- Your life matters more than assets. If threatened, call 112 (the EU emergency number) and do not resist armed attackers.
Sources
- CertiK Intel3D: Wrench Attacks H1 2026
- Decrypt: CertiK data on $124M in related value
- Cointelegraph: home invasions, CertiK H1 2026
- Cointelegraph: CertiK, 72 incidents in 2025
- Chainalysis: violent attacks in 2026
- Cointelegraph: more than $30M stolen
- Crypto Briefing: L. Nuñez, 77 cases
- OCCRP: French prosecutors and underage perpetrators
- The Local / AFP: the kidnapping of D. Balland
- ForkLog: ransom size and the freezing of funds
- Ledger: the 2020 data breach
- The Block: Ledger customer data published
- Help Net Security: the Coinbase breach
- The Block: DGFiP leaks in France
- Cointelegraph: the Waltio breach
- Decrypt: fake police officers in France
- Cointelegraph: the attempt to kidnap Tim Heath in Estonia
- ForkLog: planned kidnappings in Latvia
This lesson is educational and is not financial, legal, or security advice.