There is an average of one wrench attack per week.
This was just a prediction of cypherpunk and software engineer Jameson Lopp. However, he stressed it appears that this trend is on track this year, as there is a rising number of documented wrench attacks.
Increasing Wrench Attacks
In a post on X, Lopp highlighted that 25 wrench attacks have been documented in the first 21 weeks of 2025.
“My prediction that we’ll average 1 attack per week this year is looking on target.”
In response to one of the post’s replies, he noted that there have been zero reported attacks in El Salvador and nine in Dubai, as all attackers were quickly apprehended in these countries.
Lopp then shared that the success rate of wrench attacks on other countries remains steady at 60%, and failures typically result from general operational security practices rather than anything crypto-specific.
Meanwhile, a commenter suggested using time locking to protect against wrench attacks, sharing that they have time-locked their cold storage Bitcoin for their son’s retirement, making it inaccessible to attackers.
In response, Lopp stated that time locks are “tricky.” He cited Casa’s blog, which explained that while time locks can help prevent forced transactions during a wrench attack, they are complex to implement. It is because time locks pose challenges for key rotation and wallet recovery.
In 2017, Lopp was targeted in a swatting attack after an anonymous caller falsely reported a hostage situation at his home, prompting a major police response. Swatting is a malicious act where someone falsely reports a crime or emergency to law enforcement, leading to an aggressive response, often involving a SWAT team, to the victim’s residence or workplace, as defined by Business Insider.
Motivated by his crypto involvement, the attacker later issued a $50,000 worth of $BTC extortion demand. Lopp refused to pay, instead opting for extreme privacy measures and investigating the incident himself, which he detailed in a blog post titled To Swat a Swatter.
What are Wrench Attacks?
A wrench attack is a form of physical coercion in which an attacker uses threats, violence, or even kidnapping to force a victim to surrender sensitive information such as cryptocurrency private keys or passwords.
Unlike cyberattacks that exploit digital vulnerabilities, wrench attacks bypass technological defenses entirely by targeting the human element, regularly with brutal efficiency.
The term comes from a well-known webcomic that satirically points out how an attacker could avoid the complexities of cryptographic hacking by simply using a “$5 wrench” to extract the needed information through physical intimidation.
Wrench Attacks on the Rise: May 2025 Strikes
As cryptocurrencies gain value and mainstream attention, attacks on holders are becoming more frequent. Criminals are increasingly targeting individuals known or believed to own large amounts of crypto, with some of the most alarming incidents involving kidnappings and ransom demands. In these cases, victims are often coerced under life-threatening pressure to hand over their digital assets.
According to the ongoing log compiled by Lopp, there were 18 documented physical attacks targeting individuals with Bitcoin or other cryptocurrencies in 2023, rising to 24 incidents in 2024.
By January 2025, eight attacks had already been documented, followed by five each for February and March, and one additional case in April.
Here are the attacks recorded in the month of May alone:
- Paris Crypto Kidnapping: A man was kidnapped in Paris by masked assailants who demanded a ransom of €5 to €7 million from his crypto-millionaire son.
- The victim was mutilated, with one of his fingers severed, and held captive until French police raided a suburban property and arrested five suspects in connection with the violent extortion plot.
- NYC Crypto Torture Arrest: A Manhattan cryptocurrency investor, John Woeltz, was arrested and charged with kidnapping, assault, and unlawful imprisonment after allegedly detaining and torturing a 28-year-old Italian tourist in a luxury SoHo townhouse.
- Police said the victim was held for weeks, beaten, and hung off a ledge after refusing to give up his Bitcoin password. The victim eventually escaped and is now in stable condition.
- A second suspect, Beatrice Folchi, was also arrested. Authorities found firearms and Polaroid photos documenting the abuse.
- Fake Uber Crypto Robbery: An American crypto tourist in London was allegedly drugged by a fake Uber driver who stole $123,000 worth of $BTC and $XRP.
- The suspect posed as a ride-hailing driver, drugged the victim, and accessed their crypto wallet during the encounter.
- Failed Paris Kidnapping: An armed gang attempted to kidnap the daughter and grandson of the CEO of French crypto exchange Paymium in Paris’s 11th district.
- The attackers, four masked men, tried to force the victims into a van in broad daylight. The woman resisted, managed to disarm one of the assailants, and the attackers fled after bystanders intervened.
- Paraguay Crypto Theft Bust: Three undocumented Chinese immigrants were deported from Paraguay after being caught attempting to steal cryptocurrency mining machines from Teratech SA’s facility near the Itaipu hydroelectric dam.
- A fourth individual, a Paraguayan legal resident named Nahun María Velázquez Garcete, was arrested and charged with aggravated theft.
- Authorities suspect the group may have ties to the facility and are investigating possible links to a broader criminal organization.
- Uganda Crypto Founder Abducted: Festo Ivaibi, the founder of Ugandan crypto education firm Mitroplus Labs, was abducted at gunpoint near his home in Kampala on May 17, 2025.
- Armed men impersonating military officers forced him to unlock multiple crypto wallets and transfer approximately $500,000 in cryptocurrency to their accounts. The attackers also coerced the sale of some of Afro Token, a meme coin created by Mitroplus Labs.
In the Philippines, Chinese Filipino businessman Anson Que and his driver were kidnapped and later found dead in April 2025. A ransom of ₱200 million was partially paid in cryptocurrency.
Authorities identified five suspects, including alleged mastermind David Tan Liao (in custody) and Kelly Tan Lim (still at large), who allegedly orchestrated the abduction and ransom transfer. A bounty of ₱10 million is offered for Kelly’s arrest.
This article is published on BitPinas: 2025 Sees Surge in Wrench Attacks as Weekly Average Hits One
What else is happening in Crypto Philippines and beyond?
