Forty-six knocks on doors that cryptography cannot answer.
Twelve of those knocks ended in payment. More than thirty million dollars in digital assets left their owners' control in 2026 alone — not through a zero-day exploit, not through a compromised seed phrase, not through any flaw in the elliptic curve mathematics that secures these networks, but through the oldest attack vector in human history: one person's capacity to inflict harm on another.
The Chainalysis report that documented these numbers landed with the quiet weight of a confession. No vulnerability disclosure. No patch available. The attackers are not breaking cryptographic primitives; they are dismantling the philosophical assumptions stacked on top of them.
Silence is the loudest warning.
I have spent nearly a decade writing about the geometry of trust in decentralized systems. In 2017, amid the ICO fever, I found myself captivated by the structural elegance of early Ethereum contracts — the way Golem's Sybil resistance folded into itself like origami. I believed then, with the conviction of a young mathematician, that the beauty of the code would be enough to protect its users. But geometry remembers what markets forget: trust is built on human bodies, not just on code. And bodies carry a vulnerability that no elliptic curve can address.
This is the story of how that vulnerability became an industry.
The Old Joke, Reborn
Rubber hose cryptanalysis is an old joke in cryptography circles. The punchline is that the most reliable way to break any encryption is not to solve the computational problem but to apply a rubber hose to the person who knows the solution. For decades, it remained a punchline because the scenario felt absurd. Crypto holders were engineers in basements, early adopters with laptops and curiosity. The stakes were hypothetical.
The joke is no longer funny.
The attack pattern documented in the report follows an almost boringly simple arc: identify someone who controls significant assets, approach them in the physical world, and apply calibrated pressure until a private key appears or a transaction is signed. Forty-six such attempts have been tracked in the current reporting period. Twelve succeeded. Nearly twenty-six percent of attempts ended in payment.
Let me sit with that number for a moment, because the economics buried inside twenty-six percent are the most important data point in the entire report. This is not an anomaly or a headline-grabbing outlier. It is a statistical distribution. And distributions, once they stabilize, become the basis of rational decision-making — by both sides of the conflict.
The Mathematics of Predation
During the quiet bear market of 2022, when the industry's attention had drifted elsewhere, I spent months auditing the governance structures of mid-sized DAOs. I found twelve critical centralization flaws in their voting mechanisms — pools of voting power concentrated in wallets that the protocols' own documentation claimed were dispersed. I wrote about those findings in gentle, constructive terms, because the point was never to shame the teams but to show them where their assumptions had failed. The code executed perfectly. The architecture was the flaw.
Wrench attacks follow the same logic.
The 2026 data yields a straightforward expected value calculation for would-be attackers. Thirty million dollars divided by twelve successful attacks is approximately two point five million dollars per successful operation. Multiply that by the twenty-six percent success rate, and a criminal enterprise can anticipate roughly six hundred fifty thousand dollars in expected value for every attempt it launches. Subtract the costs — information gathering, physical surveillance, logistics, the risk of prosecution — and the margin still clears the threshold that sustains organized, repeated activity.
This is not random violence. This is portfolio management.
Twenty-six percent is the number that should unsettle this industry, because it announces that the attack pattern has reached economic equilibrium. It is no longer the desperate act of an opportunist. It is the calculated practice of professionals. And professionals iterate. They share tradecraft, refine targeting, optimize extraction. The report's observation that attacks are expanding to family members is not an emotional escalation; it is a strategic expansion of the attack surface. A holder can resist pain. It is far harder to resist the threat of harm to the people they love.
The Data Amplification Loop
Here is where the story becomes properly uncomfortable for an industry that has spent years celebrating its own transparency.
Wrench attacks are not new. Physical coercion is as old as property itself. What is new in 2026 is the precision with which attackers can select their targets. That precision is enabled by two data flows the industry has built, celebrated, and monetized.
The first is the blockchain itself. Public, permanent, and transparent by design, the chain records every meaningful holding and every significant transaction. On-chain analytics — the same tooling law enforcement uses to trace criminal proceeds — allow anyone with sufficient skill to map the distribution of wealth across the network. You do not need a data leak to know who holds a thousand ether. You need to read the block explorer. The map is free; the violence is optional.
The second is the KYC apparatus that centralized exchanges maintain under regulatory mandate. Every identity verification, every home address, every phone number collected for compliance purposes becomes another coordinate in a targeting database. When those databases leak — and they leak with the grim regularity of a tide schedule — the data does not simply expose users to phishing or account takeover. It exposes them to physical danger.
A phishing victim loses funds. A wrench attack victim may lose their life.
The report explicitly links data breaches to the expansion of physical security risk. This is the amplification loop: on-chain analytics identifies the holding, KYC data identifies the human, and the physical world takes over from there. The blockchain tells the attacker what you have. The exchange tells the attacker where you live.
This is the quiet tragedy of compliance-first architecture. The apparatus designed to make the financial system more transparent to regulators has made holders more transparent to predators. We built a surveillance satellite, and we are shocked to discover that cartographers of violence are reading the maps.
The Geometry of Broken Assumptions
Let me walk through the defenses the industry currently offers, because each one contains an assumption that wrench attacks invalidate with surgical precision.
The hardware wallet assumes that the private key never leaves the device. This is true in the digital sense. But the device does not need to be compromised; its owner does. A wrench attack does not ask the hardware wallet to sign a transaction. It asks the human holding the hardware wallet to type the PIN. The cryptographic assumption holds perfectly. The human assumption does not.
The multisig wallet assumes that distributing trust across multiple signers reduces risk. Architecturally, this is sound. An attacker would need to compromise multiple thresholds to access funds. But the attack model has shifted. The attacker does not need to compromise three of five signers simultaneously. They can threaten signer number one today, signer number three tomorrow, signer number four next week. The mathematical threshold was designed for a world where signers are remote and adversarial, not for a world where they have homes, families, and addresses sitting in the leaked database of a regulated exchange.
Shamir backup splitting assumes that distributing seed phrase fragments across locations prevents a single point of failure. But every fragment holder is now a potential target. You have not eliminated the single point of failure; you have multiplied the points of coercion.
And here is the deepest irony: MPC solutions, which I genuinely admire for their technical elegance, face the same vulnerability. The key shares are meaningless to an attacker. The share holders are not.
Every defense in the modern self-custody toolkit assumes that the attacker can only reach the code. Wrench attacks remind us that the human is always within reach. From my audit work, I have learned that the most resilient systems are the ones that explicitly name their threat model. The industry's threat model has been incomplete for years. We have audited smart contracts, tested oracle manipulation, stress-tested economic exploit scenarios — and all the while, the simplest attack waited patiently outside the codebase, in the parking lot, at the school gate, at the front door.
The Game Theory of Duress
This brings me to a question that every security professional in this industry needs to answer honestly: what is the optimal strategy for a victim under duress?
The naive answer is resistance. Refuse to comply. Accept the loss of funds. Protect the asset at any cost. But this calculus ignores that the attacker controls the escalation ladder. If you refuse to provide a key, the attacker can escalate from threats to violence. If you provide a decoy wallet with a modest balance, the attacker may or may not be satisfied.
The sophisticated answer is plausible deniability: the ability to convincingly demonstrate that you hold less than you actually do. It is an old concept in cryptography and an ancient one in human conflict. The holder maintains a decoy wallet with a plausible-seeming balance, and under pressure, produces the decoy, surrendering a manageable portion of the total to preserve the rest.
But plausible deniability is difficult to implement retroactively. If you have been active on-chain for years, if your transaction history reveals accumulating positions, if your public persona affirms your enthusiasm for crypto, the decoy story collapses under the weight of the evidence. The cover must be maintained for years before it becomes necessary. The strategies that work are the ones designed into a life, not bolted on after the threat appears.
This is why coercion resistance must be understood as a protocol — a human protocol — that operates alongside the technical one. It includes decisions about which wallets to track on-chain, which addresses to connect to centralized exchanges, which social media posts to publish, which real-world identifiers to keep separate from the self-custody digital identity.
Prune the Dead Branches
I need to say something now that will make some of my long-time readers uncomfortable. It makes me uncomfortable too.
The not-your-keys-not-your-coins ethos that has defined this industry since the exchange collapses is incomplete. Self-custody is a necessary protection against institutional failure, but for holders above a certain threshold, it can become a targeting mechanism. When you have moved your assets off the exchange, when you have ensured that no KYC database contains your holding information, you may have achieved financial sovereignty. You have also, potentially, become a more attractive target for violence — because the absence of institutional custody signals that the private key exists in one person's mind, one piece of paper, one metal plate, one vulnerable human body.
The report hints at this uncomfortable truth. The victims of wrench attacks are disproportionately people who did everything right from a purely digital security perspective. They used hardware wallets. They used multisig. They kept their seed phrases in tamper-evident bags. What they could not make unsearchable was their existence as human beings.
I have begun to wonder whether universal self-custody is the right recommendation for every holder in every circumstance. A young person with modest holdings faces different risks than a family office with eight figures in assets. For the family office, institutional custody — with its physical security, insurance, and procedural controls — may diffuse the attack surface across an organization rather than concentrating it on a single human being. It is a compromise with the centralized devil, and it may be the rational one.
Prune the dead branches, save the tree. The dead branch is the dogma that self-custody is always superior, in all circumstances, for all people. What we need instead is a spectrum of custody solutions matched to real threat models, real geographies, real lives.
The Social Layer
This is where the analysis points to a conclusion that will feel unsatisfying to engineers: the solution to wrench attacks is not primarily technical.
Technical measures can help. Duress modes can be implemented. Decoy wallets can be funded. Zero-knowledge proofs can obscure holdings. Privacy infrastructure is not a luxury for criminals; it is a fundamental safety layer for ordinary people. The more transparent we are on-chain, the more we invite physical violence into our lives.
But the deepest protection may be social.
This industry has normalized the celebration of wealth. Pump icons. Influencers flexing balances. Collectors displaying portfolios like plumage in a mating ritual. We have created a culture in which revealing your holdings is status-seeking behavior, and we did it while building a public ledger that records every move. The very concept of "Proof of Human Intent" that I have been exploring for the past year is incomplete if we do not also respect the right to remain invisible.
The cultural shift needed is a return to the early ethic of discretion. The survivors of this era — the people who will continue to thrive through it — are the ones who have internalized that the chain is public but your life does not have to be. We need communities where it is not just acceptable to be modest about one's holdings, but expected. Where the question "how much do you hold" is met with a blank, polite smile and a change of subject.
This will feel like a retreat to some. I think of it as camouflage. The garden survives because it does not advertise the location of its most valuable plants.
The Test That Matters
The next generation of wallets will be judged by a different standard. Not by user experience alone. Not by gas optimization or brand partnerships. By their answer to a single question: when a stranger with intent to harm stands in front of you, what does this device allow you to do?
Some will answer with duress modes and decoy wallets. Some will answer with distress signals woven into signatures. Some will answer with social recovery schemes designed not for convenience but for safety. The industry as a whole must answer, because the threat is not hypothetical. Forty-six knocks have already happened this year. Twelve doors have already opened.
The most beautiful code in the world cannot protect you from someone who has decided your life is worth less than your private key.
Takeaway
The geometry of trust was never only about code. It was always about the relationship between the mathematical and the human. This report is a reminder that the human layer is not a peripheral concern of security architecture; it is the foundation on which everything else rests.
DeFi breathes. It grows. It evolves through protocols and institutions and the people who animate them. But a garden cannot survive if its most vital plants are being harvested in the night by those who learned to bypass the fence.
We have spent two decades building unbreakable locks. It is time to remember that locks are only as strong as the hands holding the keys.
The best answer to the wrench attack is not a better vault. It is a community that has learned to walk softly, to protect its members' privacy, to treat discretion not as paranoia but as wisdom. Crypto was built on the promise of individual sovereignty. The next chapter will test whether we can protect the individual — body, family, and all.
