Introduction

Wrench to your head, your crypto, or your life? This is exactly the dilemma that victims of wrench attacks face.

As cryptocurrency gives you custody of your assets, so do you bear the risks associated with it. While attention is often focused on digital threats such as phishing attacks or malware, physical dangers are also present.

According to a research paper by the University of Cambridge, Wrench Attacks could be traced as far back as 2012 with a gradual increase in frequency as the price and popularity of Bitcoin started growing, 2021 would see the highest documented so far, with 25 attacks recorded. As of October 2024, there has been a notable rise in wrench attacks across Western Europe, Findings from the popular crypto-detective, ZachXBT indicate multiple reports of robberies specifically targeting cryptocurrency holders.

What is a Wrench Attack?

A wrench attack is the physical targeting of cryptocurrency holders to unlawfully obtain possession and ownership of their assets through physical force or threat of harm. The popular term “$5 wrench attack” first appeared in the webcomic, XKCD, where two characters planned a physical attack using a $5 wrench to force the victim to provide information rather than hacking his computer.

Although a popular weapon of choice, the wrench is generally used as a metaphor, to refer to other weapons. Different incidents have reported the use of various weapons, including knives, machetes, and firearms.

Source: XKCD

Unlike traditional financial systems, which have checks, balances, and authorities that can reverse or freeze suspicious transactions. Crypto transactions, especially via decentralized routes are irreversible, with no central authority to appeal to for help. This makes wrench attacks a lucrative deal for criminals as they are almost impossible to trace.

Some Popular Wrench Attack Incidents

Canadian CEO Attacked

In 2024, Dean Skurka, the CEO of WonderFi, a Canadian crypto company, was attacked. Skurka was released unharmed after paying a ransom of 1 million Canadian dollars.

Ledger Co-Founder Attack

In January 2025, David Balland, co-founder of crypto wallet developer Ledger, and his wife were kidnapped in France. In a brutal show of force, the kidnappers mutilated one of Balland’s fingers and sent it to his associates demanding a ransom in cryptocurrency. Mr. Balland and his wife would later be rescued by law enforcement agencies.

How Wrench Attacks Happen

With wrench attacks, there is always a high probability that the victims are intentionally targeted to exploit them for their assets, while wallet addresses make the holders anonymous, oftentimes, holders indirectly expose themselves by publicly boasting about holdings, sharing wallet balances, or showcasing digital assets increasing the likelihood of becoming a target for physical threats. Attackers can gather personal information about their targets through social engineering or doxxing (publishing private information). This data can include home addresses, routines, or places they frequent, which are used to plan the attack.

Close associates aware of the victim’s crypto holdings can also betray them, either by planning a wrench attack themselves or leaking sensitive information to criminals.

How Wrench Attacks Happen
Source: Ordekian et.al.,2024

Preventive Measures Against Wrench Attacks

1.Stay Anonymous: Avoid disclosing your cryptocurrency holdings publicly, especially on social media. Use pseudonyms for public discussions about crypto and avoid connecting your real identity to your wallet address or crypto-related activities. Limit sharing personal information online (e.g., address, phone number) that could help criminals identify and target you.

2.Use Multi-Sig Wallets: Multi-signature (multisig) wallets require multiple approvals to authorize a transaction, often from different devices or individuals. This makes it harder for an attacker to transfer funds, as they need access to multiple keys. You can set up a multi-sig wallet with a trusted third party or across different devices you control, reducing the likelihood of being coerced into a single-point transfer.

3.Cold Storage for Large Holdings: Store most of your cryptocurrency in cold wallets (hardware wallets not connected to the internet). Cold wallets cannot be accessed remotely and are much safer from hacking or physical threats.

Keep these cold wallets in secure, undisclosed locations (e.g., safe deposit boxes), minimizing the risk of being coerced into accessing them quickly.

4.Use Safe Custody Services: If you have large holdings, consider using institutional custody solutions. These services often offer additional layers of security, including insurance, multisig, and off-site storage, minimizing the risk of physical coercion.

5.Diversify Your Assets: Spread your crypto assets across multiple wallets. By doing so, even if you’re forced to surrender one wallet, the attacker won’t have access to your full holdings. Use smaller “decoy” wallets that contain a minimal amount of cryptocurrency to give attackers if threatened, while keeping the majority of your assets safe.

6.Secure Your Physical Space: Strengthen your home and office security by installing surveillance systems, security alarms, and robust locks. These can deter potential attackers and alert authorities if an attack occurs. Consider employing personal security measures, especially if you hold a significant amount of cryptocurrency.

Conclusion

The decentralized nature of cryptocurrency provides users with full control over their assets but also brings significant risks, including the threat of wrench attacks. As cryptocurrency adoption expands, vigilance against both digital and physical threats becomes increasingly essential. By taking steps such as keeping holdings private, utilizing multi-sig wallets, storing assets in cold wallets, and enhancing physical security, individuals can reduce their vulnerability to these targeted attacks.