How crypto wrench attacks work
A 'wrench attack' is an in-person robbery aimed at crypto. Criminals target people they believe hold large amounts of crypto and try to get into their homes, for example by posing as delivery workers. They use force or threats to make victims unlock phones, sign in to exchange accounts, or reveal recovery phrases, and transfer the funds. Federal prosecutors have charged such cases as robbery and kidnapping.
Warning signs of a wrench attack
- You or your family have shared crypto holdings, wealth, or your home location publicly.
- Unexpected deliveries or visitors asking you to open the door.
- Strangers asking detailed questions about your crypto or where you live.
- Signs someone is watching your home or following you.
- Online threats that mention your address or family.
- A 'delivery' or service worker insists on coming inside or handing something over in person.
How to protect yourself from wrench attacks
- Do not advertise crypto holdings on social media or in public.
- Limit personal information such as your home address and phone number online.
- Verify deliveries and service visits before opening the door.
- Keep large holdings in storage that cannot be unlocked quickly by one person on one device.
- Talk with household members about safety plans.
Robbed of crypto in person? What to do now
- Your safety comes first. Call 911 as soon as it is safe.
- Report the crime to local police and the FBI (ic3.gov or a local FBI field office).
- Preserve evidence before anything disappears: screenshots of chats, profiles, websites and app screens, plus receipts, emails, and a written timeline. Do not delete conversations or the app. Record transaction hashes, receiving addresses, and times as soon as possible.
- Contact exchanges involved to freeze accounts and flag receiving addresses; see /guidance/crypto-stolen-first-72-hours.
- Also report to the FTC at reportfraud.ftc.gov if personal data was taken, and change credentials from a secure device.
- Watch for recovery scams. Anyone who contacts you offering to get your crypto back for an upfront fee, or who claims to work with the FBI or IC3, is likely a scammer. IC3 says it will never ask for payment to recover lost funds or refer you to a company that does. See /guidance/can-stolen-crypto-be-traced.
Physical crypto safety: common questions
What is a crypto wrench attack?
An in-person robbery aimed at crypto. Criminals use force or threats to make victims unlock phones, sign in to exchanges or reveal recovery phrases, and then transfer the funds. Federal prosecutors have charged such cases as robbery and kidnapping.
How do I keep my crypto safe from physical theft?
Don’t advertise your holdings or your home location, verify deliveries and visitors before opening the door, and keep large holdings in storage that one person can’t unlock quickly on one device.
What should I do right after an attack?
Your safety comes first: call 911 as soon as it’s safe. Then report to local police and the FBI, and record the transaction hashes, receiving addresses and times as soon as you can.
Can crypto taken in a robbery be traced?
Yes. The transfers are recorded on the blockchain, and exchanges that receive the funds can be asked to freeze them. How tracing works.
This guide is general information, not legal or financial advice. ChainWatch is not a law firm and does not guarantee fund recovery.
Sources
- justice.gov/usao-ndca/pr/three-tennessee-men-indicted-robbery-kidnapping-and-conspiracy-ch
- ic3.gov/PSA/2022/PSA220208
The information on this page was checked against the sources listed in September 2026. Laws, agency guidance, company policies and contact details change, so please verify the current information with the original source before you act.