Béthune prosecutor’s office investigates kidnapping of crypto worker’s family in wrench attack

At around 4 a.m. on September 20, a crypto-industry IT worker and his family were bound by four masked intruders in their home in Vendin-le-Vieil, a small commune in northern France. Over the next two to three hours, the attackers coerced the father into transferring roughly €40,000 in digital assets before fleeing, leaving him and his 12-year-old daughter with minor injuries.

The suspects remain at large. An investigation has been opened for unlawful confinement and organized gang extortion, with local police working alongside France’s anti-cybercrime office.

France’s wrench attack epidemic

The term “wrench attack” refers to a brutally simple concept: skip the hacking, grab a wrench (or zip ties, or a knife), and force someone to hand over their crypto keys in person.

More than 70 crypto-related violent incidents have been logged in France during just the first eight months of 2026. That figure represents close to 80% of all documented cases across Europe. Since 2023, the cumulative count has surpassed 135 incidents linked to cryptocurrency holdings.

Over 40% of incidents in early 2026 involved targeting family members, not just the crypto holder themselves. Home invasions have become the preferred method, with attackers banking on the fact that people will comply faster when their children are in danger.

Why France, and why now

Two forces are converging to make France the epicenter of these attacks. The first is data. Breaches at crypto platforms and service providers have leaked personal information, including home addresses, phone numbers, and sometimes even wallet balances, of digital asset holders. That information circulates in dark-web marketplaces and Telegram channels, essentially creating a shopping list for violent criminals.

The second factor is the nature of crypto custody itself. Unlike a bank robbery, where the institution absorbs the loss and insurance mechanisms exist, a wrench attack extracts value directly from the victim with no intermediary to call, no fraud department to reverse the transaction, and no chargeback mechanism. Once the funds move on-chain, they’re gone.

French authorities have scrambled to respond, with specialized organized crime units resulting in around 200 arrests and numerous indictments by mid-2026. The involvement of the anti-cybercrime office in this case signals that investigators recognize these are not ordinary home invasions.

The victims, many of whom work in the industry rather than being wealthy investors, are often targeted based on their employer rather than their personal net worth. An IT specialist at a crypto firm does not necessarily hold millions in personal assets, but criminals operating off leaked employee databases may not know that until they’re already inside the house.

The broader chill on crypto participation

Some industry participants have responded by adopting operational security practices more commonly associated with intelligence work: using PO boxes, scrubbing social media, separating work and personal identities, and storing the bulk of holdings in hardware wallets kept in undisclosed locations.

The Béthune prosecutor’s investigation is ongoing. Whether it produces arrests will depend on whether blockchain forensics can trace the stolen €40,000 before it disappears into mixing infrastructure. In the meantime, the count of French wrench attacks in 2026 now stands north of 70, with four months still left in the year.