Most people picture crypto risk as a hacked wallet or ransom demands over stolen data. The attacks we document happen in person: at the front door, on the road, at a meeting. Many start close to home, with an address in a leaked customer file, a business partner who knows their holdings, or a fake courier.
Personal security decisions need evidence.
Gart Research keeps two open records of how technology is changing personal safety: physical attacks to take crypto, and the personal data leaks that can tell an attacker who holds assets and where they live. For Gart Research 2.0 we rebuilt the attack record and added the leak record alongside it.
We study each case so you can judge your own risk by what has happened to people in a similar position. The cases repeat patterns, and a pattern you know is one you can plan for.
We use the same records and case studies in our private advisory and training sessions. There we help clients assess the threats they face, then prepare and rehearse a plan for each critical scenario with their family or team.
As of 12 November 2026:
- we track 841 physical attacks to take cryptocurrency, in 77 countries
- at least 1,241 people attacked in them
- 304 personal data leaks, 172 of them with home addresses
Physical attacks ($5 wrench attacks)
gart.io/research#physical-attacks
The name comes from an xkcd comic: strong encryption does not help if someone can force the secret out of its owner with a $5 wrench. Our record collects the real cases: physical attacks to take crypto and, often, cash and valuables with it. They come from public reports in 77 countries since 2014.
The visualization
Every case is captured in four steps (targeting, approach, the attack itself and the outcome), labeled by our researchers from the sources, with a plain-English summary and a count of the people attacked.
The visualization draws the whole record by these steps. Select a label or filter by country and year to study the matching cases.
Interactive visualization and search by Targeting > Approach > Attack > Outcome
Insights from the attack record
Here are a few highlights from the record. Our full report, Old crime, new speed. Personal security in 2026: AI, crypto and leaked data, comes out in a few days. Sign up on the research page to receive it first.
Crypto moves the money.
Attackers want wealth, and crypto lets them move it fast and across borders. Online, crypto was involved in 54% of the losses reported to the FBI in 2025. In person, attackers went after crypto in at least 841 physical attacks. The research page sets the two side by side.
Many attacks start with someone trusted.
Almost half of the cases, where the sources say how the attackers found the person, began with someone the person knew: a business counterparty, an acquaintance, an insider, or a relative or partner. In 144 of all 841 cases the attackers came in a role people are taught to trust, as police, an official, a courier or a driver. The full counts are in the human factor section.
Families, staff and neighbors are part of the picture.
Among the people attacked are 207 partners and relatives, 71 employees and guards, and 103 neighbors and bystanders. In 33 cases the person attacked held far less crypto than the attackers believed, or none at all, and in 14 more the attackers went to the wrong person or address. Most of the wrong address cases on our record are recent, from 2026.
Home invasions overtook kidnapping in 2026.
Kidnapping is the most common type of attack overall, with 345 cases. In 2026 so far, home invasions have overtaken it with 71 recorded cases against 53 kidnappings.
How the attacks ended.
48 attacks were stopped before anyone was held, for example when an alarm went off, a door stayed shut or a plan was uncovered. In 52 more the person got away, and in 94 police or others came to the rescue. But violence was common: someone was physically hurt in more than half of the attacks, and at least 59 people died, in 48 of them.
Data leaks
gart.io/research#data-collection
The leak record tracks incidents in which an organization had personal data stolen, left it exposed or handed it over: names with home addresses, identity documents and selfies, account and wallet details, balances and tax records. It also counts customer lists that show who holds assets, such as the clients of an exchange, a private bank or a luxury retailer. To see where your own address may be exposed, search the leak record for the banks, exchanges and shops that have it, and check what their leaks included.
Searching the leak record by sector, company or keyword.
Insights from the leak record
Here are a few highlights from the leak record. More in the full report: sign up to receive it first.
Most leaks on record come from banks, crypto businesses and governments.
The leak record reaches well beyond crypto companies. Of the 304 leaks, 108 come from banks and other finance companies, 56 from crypto companies, 45 from government bodies, 13 from luxury brands and 7 from identity verification vendors, the companies that check the passports and selfies customers upload.
Not every leak was a break-in.
Some came from bribed or rogue staff (25), some from a third-party vendor (46), and some were handed over by the company itself (5) in answer to a forged legal request, such as a fake emergency data request sent in the name of the police. Coinbase's overseas support contractors were reportedly bribed about $200 a record.
The data that puts a name to an address.
Of the 304 leaks, 172 exposed home addresses. In 52 of them the address came with balances, transactions, wallet details or other signs of wealth, and in 88 with a national ID number or a copy of an identity document.
When a leak leads to an attack.
Of the leaks on record, 4 were followed by a physical attack and 2 by threats of one. Most ransom demands after a leak go to the company that held the data, but in a few cases the people in the data were extorted directly. In France, Le Parisien reported in 2026 that attackers who went to a couple's home in Nancy and held a family at home in Taverny had found them in the customer file stolen from Waltio, a crypto tax software company. Six suspects were charged on 11 September 2026.
AI makes leaked data faster to use.
Anthropic reported breaches run with AI that took two to three hours, and a 2026 study by Lermen and colleagues matched up to 68% of pseudonymous profiles to their owners. Sources and more figures are in the AI section of the research page. The defenses that work are the same as before: less data in fewer places, and a plan for when it leaks.
How to use gart.io/research
You do not need an account. The ideas below are a starting point: filter freely by the country and the situations you want to cover in your own security setup.
If you run a company or invest. In the visualization, select the targeting that you think is relevant to you, such as Business counterparty, and open the matching cases to see how those attacks unfolded.
If you look after a family's assets. Filter the attack record by your country and by home invasion or kidnapping. Each case has a plain-English summary of how it unfolded, from the first contact to the outcome. Read a few with the people who share your home and your accounts: most protective habits are easier to agree on once everyone has seen how the cases went.
If you report or research. Every entry links to its public source, so you can check our work, and the open API below lets you build your own counts. The research page has the summary charts as PNG downloads, feel free to use them.
Explore the research page
Each line opens that section of the research page:
- Data collection
- Data leaks
- AI speeds up the crime
- Human factor
- Crypto and crime losses
- Physical attacks
- How attacks unfold
- Search the databases
- Reports
- Use the data
- Glossary
Gart research method
We check each case against its public sources, analyze the details and add labels that allow us to study it from different angles.
We leave out rumors and cases we cannot source or that aren't relevant. Figures are the ones reported by the company, the authorities or the researchers who found the data; what an attacker says is marked as a claim.
Many attacks and leaks are never reported, so read every count as a minimum.
We research new cases continuously and also draw on two public lists: Jameson Lopp's list of physical bitcoin attacks and Zaup's record of physical attacks on crypto holders.
Data access and credit
- Data leaks: sqlite-leaks.gart.io/api/leaks
- Physical attacks: sqlite-stats2.gart.io/api/cases
Reuse the data and findings with the credit line "Source: gart.io".
If an entry is wrong or a case is missing, write to us and we will check it against the sources.
