Post Thumbnail

Wrench attacks average more than 1 incident per week in 2025

This analysis builds on Netlok’s ongoing research into wrench attack vulnerabilities. For additional context, visit our blog resources.

The darkest prediction in cryptocurrency security has come true: As of August 2025, wrench attacks against crypto holders are averaging more than one incident per week worldwide, with 30+ documented cases in less than half a year¹. Bitcoin trades near $122,000—over 50% higher than a year ago—fueling a shift from sophisticated hacking to old-fashioned violence².

As crypto values hit historic highs and identities are exposed via massive data breaches, security experts warn of “a brutal convergence of the speed of cybercrime with the violence of street crime”³. Recent statistics confirm this threat has evolved from isolated events to systematic targeting, making distress resistant authentication more critical than ever.

The Numbers Tell a Chilling Story

Threat FactorBefore 20252025+ Reality
Attack Frequency18 cases (2023), 24 cases (2024)30+ cases in less than half a year¹
Geographic SpreadMostly isolated in the USGlobal: France, U.S., UK, Canada, Asia
Target SophisticationCrypto-savvy users with strong digital securityAdvanced users with cold wallets are equally vulnerable
Criminal MethodsOpportunistic robberiesOrganized kidnappings, family targeting, weeks-long captivity
Price CorrelationWrench attacks did not reliably increase with rising Bitcoin pricesDirect link to Bitcoin’s $122,000 highs²
Insurance ResponseNo specialized policiesLloyd’s of London now offering wrench attack coverage


Why Paris Became Ground Zero

France, particularly Paris, has emerged as the epicenter of crypto violence. In one prominent case, a crypto executive was kidnapped from his home, while others saw family members targeted in broad daylight. Cases aren’t limited to continental Europe: the U.S., UK, Canada, and Asia have all reported wrench attacks in 2025.

What began as isolated cases is now a global issue, with organized crime groups and opportunistic actors exploiting public profiles and personal data.

Where Traditional Security Fails

“The brutal reality is that seemingly cryptographically perfect systems fail completely when someone puts a gun to your head”.

Traditional multi-factor authentication, hardware wallets, and encryption offer no real protection against physical coercion.

Victims report beatings, electric shocks, and even prolonged captivity until attackers achieved transfers under force¹⁰. Research now shows that even highly security-conscious holders are not immune—meaning the threat transcends technical skill or digital hygiene¹¹.

This widening gap between digital protections and physical coercion is precisely where an alternative approach is needed.

The Photolok Advantage

Unlike traditional MFA methods that collapse under physical threats, Photolok introduces adaptive, attack response visual authentication designed to transform wrench attacks from complete vulnerability into opportunities for silent resistance¹².

Duress Signaling in Action

Consider a scenario: a user pre-selects a specific photo as a “duress” photo. If forced to authenticate, selecting this photo triggers a silent alarm to security contacts and law enforcement, while granting access to the attacker. This ensures that, even during a threat, victims can discreetly signal for help without escalating the situation¹³.

One-Time Use

Each photo is cryptographically unique. By selecting a one-time use photo, you avoid photo disclosure as a one-time photo expires after it is used one time. Even if attackers gain access, this specific photo cannot be reused—significantly limiting the attacker’s ability to login in the future¹³.

Cognitive Confusion

Photolok’s visual, point-and-click system is unfamiliar to most criminals who expect passwords or PINs. Attackers may struggle to articulate demands (“click on your photos” is less intuitive than “enter your password”), creating crucial delays and confusion¹².

Risk Reduction Tools

There are a number of actions that can be taken to reduce the risk of attack and minimize harmful outcomes.

  1. Eliminate Wealth Signaling
    Remove physical addresses from public records and make social media private. Avoid conference photos or portfolio screenshots².
  2. Implement Geographic Distribution
    Multi-signature security ensures transactions require multiple approvals from trusted parties in different locations—making coercion far more difficult¹¹.
  3. Deploy Duress-Resistant Authentication
    Traditional MFA fails under physical threat. Duress-resistant systems like Photolok allow apparent compliance while secretly signaling for help¹³.
  4. Create Decoy Holdings
    Set up smaller crypto “sacrifice wallets” with modest amounts for attackers, while larger holdings are secured in hardened, separate storage.
  5. Establish Emergency Protocols
    Create silent alert systems with trusted contacts. Integrate tools (including Photolok) that notify authorities or partners during high-risk logins¹³.

From Vulnerability to Empowerment

2025’s weekly attack frequency marks a turning point in crypto security. For the first time, tools exist that change the outcomes of physical coercion, enabling individuals to silently signal for help and limit attackers’ ability to access their personal information under duress. With Photolok’s duress photo login, if someone forces a user to unlock crypto, selecting a special “duress photo” quietly alerts help without tipping off the attacker. Instead of feeling powerless, users get a way to protect their assets and ask for help, even in dangerous situations. The $5 wrench and threat of physical harm will always defeat pure encryption, but it doesn’t have to defeat human ingenuity.

Ready to enhance your security? Learn more about how Photolok can protect your assets at Netlok.com and explore our blog resources for deeper insights into duress-resistant authentication and the future of crypto security.

Sources

  1. LiveBitcoinNews – Wrench attacks: at least one bitcoiner kidnapped every week
  2. FintechNews – Crypto crime surges in 2025 set to break records
  3. Chainalysis – 2025 Crypto Crime Mid-Year Update
  4. QAZInform – Global wave of crypto-related kidnappings
  5. TRM Labs – The rise of wrench attacks and crypto-related violent crime
  6. Fortune – Lloyd’s of London offering crypto attack insurance
  7. The Week – ‘Wrench attacks’ are targeting wealthy crypto moguls
  8. Sherwood News – The alarming surge of “wrench attacks” in crypto
  9. NPR – New York kidnapping underscores rise in crypto ‘wrench attacks’
  10. CBS News – Crypto kidnappings on the rise as criminals resort to “wrench attacks”
  11. Cambridge Repository – Investigating Wrench Attacks: Physical Attacks Targeting Cryptocurrency Users
  12. Netlok – How Photolok works
  13. Netlok – Photos Not Passwords for Secure Login Authentication

More Articles