Jameson Lopp’s wrench attack crypto archive, the public list of physical attacks on bitcoin and crypto holders, now counts 702 cases, about twice what it held a week earlier. Lopp, a co-founder of the custody company Casa, wrote on X on 16 October 2026 that the archive had “just doubled the total number of known attacks to over 700”, according to Bitcoin.com News, TFTC and TokenPost. Most of the new rows came from a researcher who posts as Pizza Bitcoiner, whose AI-assisted search of local-language news, court records and police reports turned up 375 incidents missing from Lopp’s list.
This is a record-keeping story first. The added rows are mostly older cases that had never been logged, so a list that doubled does not mean attacks doubled.
The bigger dataset does show where the risk has moved. France now leads the 2026 count: 49 of the 124 entries dated this year are French, according to Coindaro’s count of the archive on 18 October. French official figures, gathered separately by the interior ministry and prosecutors, point the same way.
Wrench attack crypto archive: about 350 cases added in three days
Lopp has kept the list on GitHub since its first entry, the swatting of early bitcoin developer Hal Finney in Santa Barbara on 29 December 2014. The physical-bitcoin-attacks repository is public domain under the Unlicense. Its README table gives a date, a victim, a place and a source for each case; a file called attacks.json holds the same data in machine-readable form and feeds an interactive map. The README covers attacks that took place in “meatspace”, so online hacks and phishing are outside its scope, and it warns that the list “is not comprehensive” because many attacks are never reported.
The commit history shows how the import was done. Lopp pushed an “initial import” at 00:26 UTC on 14 October, then spent the day on clean-up commits that standardised dates and place names, fixed the ordering and shortened descriptions. On 15 October he added a Toronto case and archive links to the sources, and merged the work into the main branch at 21:24 UTC. The last change at the time of writing was the merge of pull request 234 at 13:07 UTC on 16 October.
The Toronto entry is the abduction by seven men, three of them Canadian soldiers according to the list, that Coindaro covered in our report on the Toronto kidnapping involving soldiers. The list dates the attack to 25 July 2026; it went into the list on 15 October, a day after the local press reported it.
The repository was already moving faster before the import. A workflow that regenerates attacks.json automatically was added at the end of September, and outside contributors sent in French cases on 23 and 30 September, a case from Saint-Juéry on 12 October and a fix removing a duplicate of a kidnapping-murder in Mijas, near Málaga, on 6 October. On 18 October the project showed 904 stars, 101 forks and 19 open issues.
The 702 figure checks out against the README, whose table holds exactly 702 rows. The attacks.json file had 701 when Coindaro downloaded it on 18 October: the only row missing is the Toronto case, added hours before the file was last regenerated. The counts below use the 702 rows of the table.
Lopp announced the update in two lines. “Good news: the Bitcoin Wrench Attack archive just got a lot more accurate,” he wrote, as quoted by Bitcoin.com News, before adding: “Bad news: we just doubled the total number of known attacks to over 700.” Coindaro could not read the X posts without logging in, so both quotes come from the outlets that reported them.
How an AI-assisted search found 375 missing incidents
Pizza Bitcoiner built a separate database from sources that most English-language trackers never read. Bitcoin.com News describes “AI-assisted searches across local-language news outlets, court records and police reports”, and Lopp thanked the researcher on X for “finding hundreds of new attack reports via agentic searches”, as the outlet quoted him. That database holds about 670 verified incidents in 72 countries from January 2020 to mid-October 2026, with 1,104 source links according to TFTC and TokenPost. Of those incidents, 375 were absent from Lopp’s archive; Bitcoin.com News puts the number then added at 351.
The method itself has not been published. Which AI models were used, what the searches asked for and how much a person checked each result are not described in anything Coindaro could read. The researcher’s database was not found online either, so the figures come second-hand from outlets that all rely on the same X posts.
Some cleaning is visible. In an update dated 11 October, TokenPost reported, the researcher added 38 cases across 16 countries (8 new since the previous release and 30 older ones), merged 33 duplicate records and removed 3 cases after review. Lopp’s own commits show the imported rows were also edited before the merge.
The work will not stop at 702. “My pipeline will be running every week, adding new cases and also updating old ones with new evidence,” Pizza Bitcoiner wrote, as quoted by Bitcoin.com News and TFTC.
A bigger list, not proof of a bigger problem
Old and new totals cannot be set side by side. Before the import, TFTC notes, the list showed a little over 70 incidents for 2025, already described as a record year. The same table now holds 162 entries for 2025. Nearly all of that gap is back-filling, not new crime.
Bitcoin.com News makes the same point. Better searches and wider language coverage explain part of the rise, and the newly found cases do not necessarily mean a comparable rise in actual crime. Many attacks go unreported, the outlet adds, and others never reach searchable public records; neither archive claims to capture every incident.
TFTC called 702 “a floor”. It also set out a test: if independent audits found duplicates or out-of-scope cases “above roughly 20%” of the 375 additions, about 75 cases, the doubling would point to inflation rather than discovery. TFTC presents that as a test to run, not a finding, and no such audit appeared in the reports Coindaro read. TFTC also leaves one sum open: roughly 350 earlier cases plus 375 additions would give about 725, not 702, which suggests some overlap was removed along the way.
Year by year: what the archive now counts
The table sets Coindaro’s count of Lopp’s README, by the year written in each entry, beside the yearly figures Bitcoin.com News gave for Pizza Bitcoiner’s database, which starts in 2020. The two series are close but not identical, because each list was cleaned on its own.
| Year | Entries in Lopp’s archive (Coindaro count, 18 Oct) | Pizza Bitcoiner’s database (Bitcoin.com News, 17 Oct) |
|---|---|---|
| 2014 to 2019 | 59 | not covered |
| 2020 | 35 | 37 |
| 2021 | 77 | not given |
| 2022 | 80 | not given |
| 2023 | 66 | not given |
| 2024 | 99 | not given |
| 2025 | 162 | 165 |
| 2026 (to mid-October) | 124 | 134 |
| Total | 702 | about 670 (2020 onwards) |
Inside 2026 the entries are spread unevenly by month: 23 in January, 13 in February, 23 in March, 12 in April, 8 in May, 12 in June, 13 in July, 6 in August, 12 in September and 1 in October so far, plus one row that gives only the year. The thin recent months most likely reflect reporting delay. The Toronto case, dated July, only surfaced in October.
Pizza Bitcoiner’s database also tracks harm and losses, and the figures depend on which cut is used. Bitcoin.com News, writing on 17 October, gave 413 victims held against their will, 300 injured, 31 deaths and about $394 million in losses across the 447 cases with a known figure. TokenPost, using an earlier cut of 669 cases to 11 October, reported 429 held, 288 injured, 36 deaths and $432 million across 442 cases. Neither outlet explains why the later cut shows fewer people held and lower losses, which is one more reason to read the totals as estimates.
| Measure | Bitcoin.com News (17 Oct) | TokenPost (669 cases, cut to 11 Oct) |
|---|---|---|
| Held against their will | 413 | 429 |
| Injured | 300 | 288 |
| Deaths | 31 | 36 |
| Reported losses | about $394M (447 cases) | $432M (442 cases) |
Crypto kidnappings in France: 49 of the 124 entries dated 2026
Across all years, the countries with the most entries in Lopp’s archive are France (85), the United States (77), Taiwan (51), Brazil (35), the United Kingdom (34) and Russia (32), ahead of India (29), Thailand (24) and Canada (23). The yearly split is where France stands out: 5 entries dated 2024, 25 in 2025 and 49 in the first nine and a half months of 2026, roughly 40% of this year’s cases.
| Country | Entries dated 2026 | Entries dated 2025 | Entries dated 2024 |
|---|---|---|---|
| France | 49 | 25 | 5 |
| Taiwan | 11 | 11 | 6 |
| India | 8 | 6 | 2 |
| United States | 7 | 13 | 14 |
| Russia | 5 | 8 | 2 |
| South Korea | 4 | 6 | 2 |
| Thailand | 4 | 8 | 6 |
| Pakistan | 4 | 2 | 1 |
The French government’s own figures, which come from police and prosecutors rather than press clippings, show the same climb. Interior Minister Laurent Nuñez told the ADAN crypto industry association on 30 June 2026 that France had recorded 77 kidnappings and extortion cases linked to crypto-assets since January, against 45 in the whole of 2025 and about thirty in 2024, France Epargne reported on 20 July. Coindaro did not open a ministry document, so these numbers are as reported by France Epargne.
A wider count came later. Ministry figures given to Cointelegraph and relayed by CryptoTicker put the total at 90 cases from 1 January to mid-August 2026, covering kidnapping, abduction, extortion, threats and violent theft, with 223 arrests and 126 people jailed. The ministry only began recording that category on 1 January 2026, so there is no official comparison with earlier years.
The national anti-organised-crime prosecutor’s office, PNACO, created in January 2026, counted “no fewer than 135” crypto-linked kidnappings or attempts in France since 2023 when it took stock in April, according to Cryptoast. By then 88 suspects had been charged and 75 of them placed in pretrial detention; more than ten were minors. Cryptoast adds that the 135 figure has since been passed.
Other trackers give other numbers, because each defines an attack in its own way. The gart.io statistics site counted 73 French attacks in 2026, ahead of 66 in the United States and 27 in the United Kingdom, while Chainalysis counted 30 publicly known violent incidents in France to mid-year and said the real figure was almost certainly higher, both according to CryptoTicker. Some trackers count only kidnappings; others take in home invasions and threats.
Leaked personal data is the suspected link
No single cause has been proven, but leaked personal data is the explanation most often given. In 2024 a tax official in the Paris region leaked personal, financial and crypto-holding information on French taxpayers, and a breach disclosed in January 2026 at Waltio, a French crypto tax platform, affected about 50,000 users, CryptoTicker reported. Chainalysis researcher Eric Jardine told the outlet the surge was “very likely linked to a significant data breach”. Ledger confirmed on 5 January 2026 that customer information had been exposed through a breach at its payment provider Global-e, Cryptoast reported.
The French series includes the January 2025 kidnapping of Ledger co-founder David Balland, whose finger was cut off and sent to his relatives to back a ransom demand, as France Epargne recalled. Cases have kept coming. In Nice on 6 September 2026, two hooded men held a mother and her son at home and took a wallet, a passport and two phones; one phone held the access codes to a crypto account worth about $25,000, according to FranceInfo as cited by Cryptoast. Near Rennes, at Vern-sur-Seiche, a family was held and assaulted on 22 August by attackers who had the wrong house, Ouest-France reported on 4 September.
For French readers the tax angle adds to the worry. Crypto tax filings put names, addresses and holdings in one place, and the 2024 case shows a leak can start inside the administration that keeps them.
Two Italian cases in 2026, one of them fatal
Italy has 9 entries in Lopp’s archive, two of them dated 2026. In Milan on 23 January, Alexander Adarich, a 54-year-old Ukrainian former banker, was lured to a B&B and held; investigators believe the aim was to force a transfer of €250,000 in crypto. He fell from a fourth-floor window and, according to forensic findings, was already dead when he fell. His 34-year-old son, whom investigators suspect of taking part in the kidnapping, was arrested in Spain on a European arrest warrant, Il Fatto Quotidiano reported on 27 February; he has not been tried.
The second Italian entry, dated 7 June in Rome, concerns a Colombian man and links to a report by Fanpage that Coindaro could not open, so no further detail is given here. The earlier Italian cases run from 2018 to 2024, in Milan, Paullo, Manerba, Turin, Rome and Concesio.
What is a wrench attack? The $5 wrench, explained
The phrase comes from xkcd comic 538, in which two characters agree that the strongest encryption is useless if they can hit the owner with a $5 wrench until he gives up the password. In crypto, a wrench attack means using violence, or the threat of it, to make someone move coins or reveal their keys.
Bitcoin holders are exposed in a particular way. With self-custody, whoever controls the private keys or the recovery phrase controls the coins, and no bank can reverse a transfer. That is the appeal of holding your own keys, and also what makes a person with keys at home a target. In his talk at the Bitcoin 2025 conference, Lopp warned against a security setup that creates “a single point of failure of you and your body”.
The archive’s early entries were mostly thefts of bitcoin ATMs and robberies during in-person trades. Later cases grew more serious, such as the kidnapping of WonderFi chief executive Dean Skurka in Toronto on 6 November 2024; CBC reported, citing a source close to the investigation, that he was released after a ransom of about $1 million was paid.
Security measures and the French alert scheme
The Bitcoin.com News report names the general security measures most often discussed. It says they can complicate a forced transfer but cannot guarantee protection. They are described here as general safety information, not as advice for any individual situation.
- Multisignature wallets, which need more than one key to move funds, so a single person under threat cannot send everything alone.
- Keys kept in separate places, so that no single location holds everything needed to move the coins.
- Spending delays that slow down large withdrawals.
The same report notes that public disclosure of holdings and face-to-face trades can expose people to targeting. Where a recovery phrase is stored is part of the same question; our guide to seed phrase security sets out the common options.
In France, a rapid alert and protection scheme for the crypto industry started in spring 2026; Nuñez said 724 industry players had registered, up 11%, France Epargne reported. The same outlet said Nexus Mutual launched crypto kidnap-and-ransom cover in February 2026 for founders, executives and large holders, with annual premiums of 0.75% to 2% of the sum covered and minimum cover of $250,000.
Weekly updates will keep moving the count
The 702 figure will not last long. Pizza Bitcoiner says the pipeline runs every week and Lopp’s repository now rebuilds its data file automatically, so new cases and corrections to old ones should keep arriving. No date for the next batch has been given.
Several questions are still open. Nobody yet knows how many of the 375 imported cases will survive further checks for duplicates and scope, or whether the 2025 total of 162 holds once more court records turn up. In France, the Nice prosecutor has opened an inquiry into armed extortion and false imprisonment, and Coindaro found no published trial date for the recent cases.
The data stays open to anyone: the README table and attacks.json can be downloaded from the GitHub repository and the counts above checked line by line.