Crypto Home Invasions: How Data Leaks Feed Wrench Attacks

Hey, Melissa. So, Y Combinator CEO Garry Tan, a friend of the victim, posted security footage showing someone posing as a delivery man rushing into a San Francisco home in broad daylight. Now, police say the intruder tied up the resident, demanded access to his financial accounts, and then stole about $11 million worth of crypto using the digital keys that were stored on the victim's laptop and phone. And inside the industry, these are known as wrench attacks, where criminals have realized that it's often easier to show up with a weapon than hack a wallet online. Facial recognition, that makes it even simpler.

You tie a victim up, point the phone at their face, and then drain their account.

One became 20. In the first half of 2025, the security firm CertiK found one publicly reported home invasion of a crypto holder. In the first half of 2026, it found 20. Nobody in that clip hacked a wallet, somebody knocked on a door. And to knock on your door, they need your address.

Which, if you have ever opened an account at a crypto exchange, is already sitting in a company's records next to proof that you own crypto. That combination has leaked before, more than once. So, by the end of this video, you're going to count something for yourself. How many places hold your name, your home address, and proof that you own crypto altogether? That is your number, and I'm going to show you which parts of it you can actually shrink, and which parts are already out of your hands.

[music]

Start with what CertiK actually counted, because the headlines rounded up. In the first half of 2026, CertiK verified 52 of what the industry calls wrench attacks. That is when a criminal skips the hacking entirely and uses a threat or force on a real person. In the first half of 2025, it was 39. Kidnappings went from 12 to 16.

Home invasions went from one to 20. France alone had 33 of the 52. The United States had four. There is also a longer record. Jameson Loop, a security researcher, keeps a public list of physical attacks on crypto owners going all the way back to 2014.

Counted by year, his list shows 42 in 2024, 85 in 2025, and 60 already in 2026 by early September. He says himself the list is not complete because many attacks are never actually reported. Chainalysis, a blockchain analysis firm, counts a little differently. It had 46 violent incidents through late June 2026 against 40 at the same point the year before. So, two firms do not agree to the decimal, but they both agree on the direction.

And both of them agree the attacks have moved into people's homes. And I know what you're probably thinking. That is France. That is gangs and famous founders and people who post their Lamborghinis online. I'm a quiet guy with a stack in a normal town.

Nobody even knows I own this. I would think the same thing. So, look at the American cases because none of them are famous people.

You don't have to be a big name. You you can certainly be a a nobody. And if you are in a data leak, for example, we believe, we don't have like hard evidence, but we believe that at least a few of these attacks are the results of data leaks from various crypto provider services over the years because some of those leaks had a lot of personal identifiable information including home addresses for people.

That is the man who keeps the longest public list of these attacks saying you do not have to be a big name. In May of 2026, federal prosecutors in Northern California's indicted three men over a $6 million robbery spree across the Bay Area and Los Angeles. Their method, in the government's words, they posed as delivery persons to gain access. In March of 2026 in Winnetka, Illinois, a man posed as a food delivery driver to get someone to open the front door. The people inside were then made to open a safe, a computer, and their crypto accounts.

Neither of those victims was a celebrity. They were people with an address and a balance. So, how does a stranger from out of state know which house is on the street has the crypto? CertiK put the answer in one sentence in a report, and it's worth reading slowly because it is the spine of this whole video. In 2026, attackers can combine leaked databases, tax or compliance records, exchange customer data, social media profiles, ENS names, public wallet activity, real estate information, and phone number intelligence to build a target package without prolonged physical surveillance.

Target package. That is their phrase. Strip it down and a target package is three things: a name, a home address, and a reason to believe that the person owns enough crypto to be worth the drive. Any one of those on its own is nearly useless to a criminal. Your name is in the phone book, your address in your mail.

Plenty of people own some crypto, but all three sitting together in one row of a spreadsheet is a shopping list. And the place those three things most reliably sit together is a crypto company's customer file.

Uh one interesting thing is that home invasions are quite common, and I suspect this is because of what I mentioned earlier with a lot of, you know, personal identifiable information, KYC information. Basically, people's home addresses tend to be very easy to find. So, if you have someone who's a known holder of digital assets, you can probably find out where they live, and most people do not have particularly hardened uh physical security at their house. And that's where we end up with a large number of home invasions. Basically, someone comes, uh knocks on the door, you open the door, and that's game over for you.

Uh very similar number

Here is the example some of you will remember because some of you may have gotten the email.

The Coinbase CEO said their investigation found that hackers approached their overseas customer support agents looking for people to accept bribes in exchange for customer information. The company got a ransom email demanding $20 in Bitcoin, which the company said they're not paying. The hack affects less than 1% of their users. Here's what Coinbase said the hackers got. Name, address, phone, and email, last four digits of social security, and masked bank account numbers.

Hackers did not get access to login credentials, private keys, and funds.

In May 2025, Coinbase filed a report with the Securities and Exchange Commission. When a public company has a serious security incident, it has to describe it in a filing, and this one is public. Coinbase wrote that someone had paid contractors or employees working in support roles outside of the United States to get customer information. Then it listed what was taken: name, address, phone number, and email. The last four digits of social security number, government ID images, driver's license, passports, etc.

And account data, balance snapshots, and transaction history. Put that list next to the target package, name, address, proof of crypto. Every box is filled and the ID photo even tells them what you look like. So, how many people were in that file and what was missing from it? According to Coinbase's filing with the Maine Attorney General, as reported by Bleeping Computer, 69,461 people were affected.

Coinbase refused to pay a $20 million ransom demand and offered a $20 million reward instead. The company estimated the cost at $180 million to $400 million. It also said no passwords or private keys were taken. That part matters, obviously, and it is true, but nobody needs your password when they have your address. Now, I've spoken to a lot of my audience in person.

In fact, we were just at a in person in Vegas, and we've all gotten these letters from Coinbase in the mail. We've gotten the letters from Ledger recently in the mail, and those are very scary situations to think about because we did We were forced by KYC to give our information to these exchanges. Now, luckily, Ledger doesn't have that much detail information. Coinbase's system has never been hacked, but the data has been. So, how does a file like that walk out of a company?

On Thursday, Coinbase [music] announced hackers bribed some of its overseas employees for customer data and demanded a $20 million ransom from the company, [music] a request Coinbase said it denied while forecasting costs up to $400 million to remedy the incident. Coinbase reported [music] in a Security and Exchange filing the company received an email on May 11th [music] from a quote unknown threat actor that claimed to have stolen sensitive information from less than 1% of its monthly [music] users, including data related to, quote, customer service and account management systems.

Coinbase itself said insiders were paid. A class action lawsuit filed against the companies goes further, and I want to be precise here because these are allegations in a lawsuit, not findings by a court. The lawsuit claims an employee at an outsourcing company's office in India photographed customer data on screen up to 200 images a day starting in September of 2024. And then it claims that those photos were sold to hackers for $200 each, and it claims details on more than 10,000 customers were on that person's phone when they were arrested in January 2025. So, if that is true, think about the price. $200 for a picture of a screen that shows a name, a home address, and a crypto balance.

That is cheaper than the gas for the drive, and Coinbase is not the only one. CertiK's report notes that Kraken disclosed an extortion attempt after insiders in its client support team recorded internal system showing client data. Different company, same weak point. Support staff who can see customer records on a screen. And once a list exists, it does not stay with that person who stole it.

This is something we're we're seeing a lot actually as a result of various data leaks. You may have heard about like Coinbase has had data be data leaks recently, a number of other exchanges and service providers are unfortunately required by government uh regulatory agencies to request and store very sensitive information, your personal information, and of course information is very difficult to keep uh from flowing freely. This information ultimately tends to get leaked, passed around, and the criminals then get a hold of that, and they use this to create highly targeted spear-phishing and social engineering attacks. That's what we're seeing happen.

And everything we're talking about here, by the way, comes out of Coinbase's own SEC filings, they're public court records, and working out how many of those records tie your name and address to your coins is the actual job. And that is what the SGS system inside of Altcoin Pro does with our clients. Most people who get this far close out the tab of this video and do nothing with this information. So, if you're the one who won't, the first link in the description gets you a chance. Book those calls while it's still fresh in your head.

Click the link down below right now. Book a call immediately. Now, some of you are thinking, all right, fine. That is why I moved my coins off the exchange. I bought a hardware wallet, and I have my own keys.

And that is obviously the most important step in the first step you should be doing. And that is the right move for the coins. But, let's look at what happened to the address. In 2020, Ledger, one of the biggest hardware wallet makers in the world, had its customer data leaked. In a letter from its own CEO, Ledger said about 272,000 people had detailed information exposed, including postal address, name, and phone number.

About 1 million email addresses leaked also. So, the list that got out was literally a list of people who had just bought a device for storing crypto with the address and the device was shipped to. The people who are most careful about their coins ended up on a list of the most precise list of all. And the company's own co-founder was not safe, either. On January 21st, 2025, Ledger co-founder David Balland and his wife were kidnapped in Verzon in central France and held for ransom.

They were rescued and police arrested 10 people.

Wanted by the world's police, Badis Mohammad Amid Bajau has just been arrested in Morocco. French media says he is suspected of being one of the masterminds behind a string of violent kidnappings, including the high-profile abduction of crypto boss David Balland and his partner in January. France's justice minister quick to take to social media to thank the North African country for its efforts in Bajau's arrest, calling it excellent judicial cooperation against organized crime. French authorities last week charged 25 people, including six minors, over a series of kidnappings and attempted abductions of people linked to the cryptocurrency trade in France.

I'm not telling you hardware wallets are dangerous. In fact, it's the complete opposite. They protect your coins from hackers and they do what the job is and they do it well. But that is also why here in the United States, I know you some of you guys watching internationally don't understand why the second amendment is so strong, but you do need security as well of some sort. But if your cold wallet is doing its job well, it does nothing about the address the device was shipped to.

So, why is France 33 of 52? Not because French crypto holders are richer or careless, Chainalysis looked at exactly this and wrote one blunt line. A data breach is the likeliest culprit of France's surge. In 2024, a French tax official in the Paris area is alleged to have looked up and sold files on high net worth crypto holders, names, addresses, holdings, phone numbers, tax records. She was an employee at a tax office in Bobigny, paid in cash and Western Union transfers, and she is in detention.

Then, in January 2026, a French crypto tax software company disclosed a breach of about 50,000 users. Then, in August of 2026, hackers took about 678,000 records from a French tax agency itself, names, home addresses, income, and family details. So, France did not get one leak, it got the target package again and again and again from the one place required to know exactly what you own, the tax office. CertiK's count went from 10 in the first half of 2025 to 33 in the first half of 2026. At Paris Blockchain Week, the French Interior Ministry acknowledged 41 incidents since January, about one every 2 and 1/2 days.

Now, I want to be careful here because this is exactly where a lot of channels overreach. Nothing in these reports say an American tax agency has leaked crypto holders' files. I have not seen that, and I'm not going to claim that. What France shows is a pattern. Any record connecting who you are, where you live, and what you hold is worth money to a criminal, and the number of places holding that record only goes up.

Every exchange that you open an account with did an ID check with your address. Every crypto tax tool you uploaded your history has your name and your balances. Every hardware wallet that you had shipped to your house has an address. CertiK's own forecast is that leaked list linking identity, address, and crypto wealth may become a specialized criminal product bought and sold on their own. That is a forecast, not a fact, but it is the security firm's, not mine.

And here's the part that should change how you think about this if you are a parent or a grandparent, the person who owns the crypto is increasingly not the person who gets taken. Chainalysis found that by early 2026, attacks aimed at family members or acquaintances were roughly 25 to 30% of the cases, up from nearly zero in 2021. In France, it's over 40%.

The young magistrate is the partner of an entrepreneur in the cryptocurrency sector. He was not home during the incident, but contacted the police a few after the kidnapping.

He had received a message and a photograph of his partner from the kidnappers demanding a ransom to be paid in cryptocurrency and threatening to mutilate the victims if the ransom was not paid promptly.

According to the prosecutor, no ransom was paid, but the suspects are still on the run.

It has already happened in America.

On August 25th, Danbury police responded to a kidnapping call near Dormia Drive in the afternoon hours. A couple was kidnapped from their car by masked men and shoved into a van. Police say the van then crashed and the men ran away leaving the couple behind. Four men were arrested around the scene and two more arrested the next morning in Roxbury.

At first, we really didn't know what we had. We knew it was a kidnapping from when the call came in. And when we actually more we looked into it, the more started uncovering some other stuff.

Detective Sergeant Stephen Castrovince says the FBI contacted them and from there they realized the kidnapped couple's son was being investigated for possible involvement in a massive Bitcoin heist.

August of 2024, Danbury, Connecticut, a couple was taken from their car. They had nothing to do with crypto. Their son was being investigated over a Bitcoin theft and the kidnappers wanted his money. In September 2026, the Justice Department announced one of the men was sentenced to 180 months or 15 years. So, your address is not only your address, it is the address of everyone who lives with you and of your parents and of your kids.

So, one thing you can do and it is smart to do is remove yourself from data brokers, data dealers, etc. Now, AI you can actually type a prompt into AI, "Hey, remove my name for all data companies, etc." That's a good piece of advice. Obviously, it doesn't remove if your data gets leaked specifically to criminals, but it does help uh reduce your footprint out there. If you want to see how an American version runs, the federal court record on one gang lays it out.

News tonight, a Florida man responsible for a cryptocurrency scheme involving a series of home invasion robberies here in the triangle was sentenced to 47 years in prison this week. You might remember the story from last year, an elderly Durham couple held at gunpoint inside their home and forced to transfer more than $150,000 worth of crypto to an unknown account. Remy Ra Saint Felix was one of three men involved in that crime, but in total 12 men have now been sentenced for their role in the scheme in which Saint Felix and his co-conspirators stole more than 3 and 1/2 million dollars through SIM swapping and those violent home invasions.

Remy Ra Saint Felix was sentenced to 47 years in federal prison in September 2024. His crew stole more than 3.5 million dollars through phone number hijacking and violent home invasions. According to the Justice Department, his co-conspirators got into one couple's email account, then spent multiple days watching their home, and the government wrote that they circulated pictures of their targets and their targets' home.

After they were tied up, the documents say the wife was dragged by her legs into a bathroom, the husband forced to log on to his Coinbase cryptocurrency account, and over the next 45 minutes transferred $156,850 $156,853 into three transactions. A fourth transaction was flagged by Coinbase. Now, the court documents say that a third man was also involved in this, but involved by finding the victims. Both Castro and St. Felix drove from Florida and spent three days watching the couple.

That elderly couple in Durham, North Carolina was held in their own home while the husband was forced to log into his Coinbase account and send about $156,000. Look at the order of operations. They did not start at the house, they started with the information, email first, and then the address, and then 3 days of watching them, then they opened the door. Every step before the door was paperwork and data. Now, I do also owe you the other side.

I don't want to be the boogeyman here cuz I'm not going to scare you with just half the picture. Nobody has a proven specific leak caused that specific attack. CertiK says its own data does not show how often insider information is actually used. And most attempts fail. Chainalysis has found that through late June 2026, only 12 of the 46 violent attempts, which is 26%, actually got paid.

In 2025, it was 49%, in 2024, it was 67%. So, attackers are getting more active and getting paid less often. And the raw count is still small. 52 verified attacks in half a year across the whole world. This is not a reason to panic or to sell.

The odds it happens to any one person that's watching this is super low. But, it is a reason to stop making yourself the easy name on the list because that part costs almost nothing. And here's the count that I promised you. Grab a piece of paper real quick. Pause this.

Write down every company holding all three pieces of the target package. Your name, your home address, and proof you own crypto. Every exchange you have verified with, including ones that you stopped using years ago, every crypto tax service you uploaded to, every hardware wallet company that shipped to your house, every conference you registered with your address. Then add one for anywhere that you have talked publicly about how much you hold. That total is your number.

The accounts from 2017 and 2021 still count. The company might be gone, but that file might not be gone. You cannot un-leak anything. Your data was in the Coinbase leak or the Ledger leak. It is out there and it stays out there.

So, be honest about which rows are already gone. But, you can stop adding rows and make the rows that exist less useful. Stop talking about your holding specific numbers, large numbers in public, to anyone that you wouldn't hand your house keys to. Think about where hardware gets shipped. A home address is the most useful line on a criminal's list.

Look at every dormant account and decide whether it still needs to exist. Closing it does not guarantee the old record is gone, but an account that you are not using is a file you're not watching. And look at the pattern in every American case here. A delivery driver, someone at the front door, a person who knows your name, decide ahead of time as a family, what do you do when a delivery driver that you do not order needs to open the door?

Security for crypto holders is seeing a lot of demand. According to one blockchain security firm, physical attacks used to coerce crypto holders to give up their credentials rose 75% last year, resulting in $41 million in known losses around the world. Isabelle Lee joins us now with more. And these are called wrench attacks. I'm not totally sure why, because that's a physical implement, but in any case, you went to the Bitcoin conference in Las Vegas just a few weeks ago and you saw this in action, the stepped-up security.

The crypto industry's own conferences now plan their security around this. Your house deserves at least the same amount of thought. So, go back to where we started, one became 20. The easy read is that criminals got more violent, and they did, but the reason they came to this house is that everything else got harder to break. Seed phrases, hardware wallets, cold storage, two-factor, the coins got safer.

So, attackers stopped going after coins and started going after the records about the person holding them. That is why every story in this video started with a record about a person, a support worker's photo, a shipping list, a tax file. Your coins can be perfectly secure and you can still be the easiest name on the list. The job now is keeping your name, your address, and your holdings from ever sitting in the same row again. One thing that I want from you, and only takes a number, put your account in the comments.

How many companies have your names, your addresses, your crypto together? Just the number. I read these comments and I want to see how it splits off with our clients here. Everything in this video came out of an SEC filing, a federal court's report, a security report anyone else can read and open. They're all public, they're all long and boring, which is exactly why nobody reads any of this information.

Well, that reading and going through this information is the job. So, not only where your money sits, but who knows it's there. And that is what the SGS system inside of Altcoin Pro does with you. Secure, grow, and scale your crypto. So, if you're holding $50,000 or more and nobody has ever mapped out where it lives and who has the record of it, well, that is the conversation you you to be having with somebody.

So, click the link down in the description below. And if you're not there yet, keep watching these videos. They're free and we're not going to stop making them. You do not have to have time to read 8K filings and federal indictments, and you should not have to take my word for it, either. Every document is linked in the description down below.

So, if you and your spouse decide on your crypto investment ideas together, bring them onto the call with you. Again, it's the first link in the description. It gets you started. Book the call. Bring a pen and paper.

You're going to learn a ton of information when you get on this call, as well. My team member is going to pour a lot of information into you. Crypto carries risk and past performance doesn't guarantee future results. This video is education, not financial advice. And you know what to do.

Stay bullish. I'll see you at the top.

[music] [music]