My Definition of a Wrench Attack
I have come to this particular definition, which may differ from others, as a way to be precise about the type of crime being committed, and to better understand what transpires: the offenders, the victims and the risks.
Any event in which a person is targeted with physical force, credible threat of physical force, real-world psychological coercion, or deception involving real-world presence — with intent to compel the transfer, disclosure, or surrender of cryptocurrency or cryptographic access credentials (private keys, seed phrases, PINs, or passwords).
A burglary where the victim is absent does NOT qualify. What is distinctive about wrench attacks is the combination: physical coercion meets direct control of cryptographic credentials, and the transfer is final and needs no institution, so the safeguards of traditional finance (withdrawal limits, reversals, fraud holds, a teller who might notice) don't apply. They are a distinctive form of robbery and extortion, not an entirely new category of crime.
The 2026 Cases
Last updated: 13 November 2026 (Dataset v2) · covers Lopp's database entries up to 31 October 2026
Each 2026 case from Lopp's database, classified against my codebook. Coding is based on Lopp's summary, the sources he links and further reporting where available. UNKNOWN means the reporting doesn't say.
Please note, not all of the wrench attacks included in Lopp's database are considered as wrench attacks per my definition. This is a limitation of the research, where different sources score attacks using vastly different metrics.
PROVISIONAL · UNDER REVIEW I have personally reviewed 11 of the 147 cases so far under the Dataset v2 codebook. The rest carry codes proposed under my coding rules and the patterns from my reviews, and are marked provisional until I review them. Reviews are limited by paywalls and incomplete reporting, so all codes are subject to change and have been assigned based on my judgement with the evidence available.
How to read the codes ▾
- A
- Court / LEA verified — court documents, police or prosecutor statements, indictments
- B
- Multi-source — two or more independent credible media sources
- C
- Single source — one credible media report
- D
- Community report — unverified, internally consistent, uncorroborated
- A-OP
- Opportunistic — no prior selection; the attacker found out about the crypto by chance
- A-TG
- Targeted — victim deliberately selected before the attack (includes lure robberies)
- A-RP
- Repeat victimisation — same victim attacked more than once
- A-PX
- Proxy — a relative or associate used as leverage to reach the holder
- A-TG/PX
- Targeted + proxy — holder targeted and household members held as well
- K-PUB
- Public profile — social media, press, talks, publicly known in crypto
- K-LEAK
- Leaked or bought data — e.g. tax-platform or exchange leaks
- K-INS
- Insider / personal connection — friend, relative, partner, colleague or business contact
- K-TRADE
- Self-identified in a trade — victim made contact to buy or sell crypto
- K-NONE
- No prior knowledge — discovered on the spot
- B-1
- None — zero planning
- B-2
- Semi-planned — target identified, not thoroughly researched
- B-3
- Fully planned — research, surveillance, set entry method, briefed crew, equipment
- B-4
- Organised — B-3 plus a transnational network, division of labour, purchased or leaked data, or a remote orchestrator
- C-0
- No physical harm — threats only, including weapons shown; foiled before contact
- C-1
- Minor force — pushed, grabbed, held down, tied up, minor bruising
- C-2
- Injury — serious bruising, cuts needing stitches, knocked out, taser injuries, drugging
- C-3
- Grievous harm — broken bones, stabbing, shooting, burns, mutilation, torture, sexual violence
- C-4
- Fatal — a victim was killed
- L-0
- None — not restrained or confined
- L-1
- Brief restraint — under an hour, or length not reported
- L-2
- Held for an hour or more at the scene
- L-3
- Abducted — forced to move to another place
- Yes
- Weapon reported, with type where known: GUN · FAKE (replica) · BLADE · STUN · BLUNT · OTHER
- No
- Reporting rules a weapon out
- UNKNOWN
- Reporting doesn't say
- D-S
- Stranger — no prior contact
- D-P
- Pseudo-stranger — posed as police, a courier, a buyer or a business contact
- D-A
- Acquaintance — known socially or professionally
- D-I
- Intimate / family — genuine partner, spouse, parent, child
- D-R
- Romance lure — offender built or faked a romantic or dating relationship to reach the victim
- D-B
- Business associate — current or former business partner, employee or provider
- E-UW
- Unlocked wallet — device already unlocked or wallet open
- E-PW
- Password / PIN coercion
- E-SP
- Seed phrase disclosure
- E-AT
- Forced transaction — victim forced to sign or approve a transfer
- E-LN
- Lightning Network
- E-MX
- Multi-sig coercion
- FAILED
- Crypto was sought but none was obtained (reason in brackets)
Confidence rating
Type A — How the victim was chosen (multiple allowed)
Type K — How the attacker knew (one main code)
Type B — Level of planning
Type C — Physical harm (highest level reached)
Type L — Loss of liberty (highest level reached)
Weapon
Type D — Relationship (offender to victim)
Type E — Access method (multiple allowed)
Multiple codes are allowed for A and E. The harm and liberty meters show the highest level reached. UNKNOWN means the reporting doesn't say; N/A means the field doesn't apply (for example, no crypto was sought). PROVISIONAL means the code has been proposed under my rules but not yet reviewed by me.