CertiK report: crypto wrench attacks jump twelvefold as hackers target holders, not code

Crypto hackers changed their target this year. It is not your smart contract anymore. It is you.

What the numbers show

CertiK’s Hack3d report for the first half of 2026 counts $1.31 billion lost across 344 incidents. The structural shift inside that total is the real story: wallet compromises became the most destructive category, accounting for $444 million from just 33 incidents. That overtakes the code exploits that defined the last decade of crypto crime.

The darkest number in the report concerns “wrench attacks,” the industry term for physical coercion of crypto holders. Those accounted for $124 million in verified losses in the first half of 2026. A year ago that figure was $10.5 million. That is a twelvefold jump, and CertiK notes it only counts publicly reported cases, so the real number is higher.

Why attackers moved to people

The logic is brutal and simple. Smart contracts got audited. Bridges got hardened. Years of expensive lessons pushed the technical attack surface down, so attackers moved to the weakest remaining link: the human holding the keys.

A wallet compromise does not require finding a flaw in audited code. It requires tricking, phishing, or physically coercing one person. The economics favor the attacker: 33 incidents produced $444 million in damage, which means each successful wallet compromise was worth on average far more than a typical protocol exploit.

Security became opsec

The uncomfortable conclusion for 2026 is that your seed phrase hygiene now matters less than not telling strangers what you hold. The perimeter is no longer the contract or the bridge. It is your public footprint: the portfolio screenshots, the conference badges, the social posts that mark you as a target worth visiting in person.

None of the old advice stops being true. Hardware wallets, multisig, and careful signing still matter. But the report’s message is that the threat model has expanded beyond software, and personal operational security, who knows what you hold and where you are, is now part of the baseline.

Security became opsec. If someone in your circle still posts their portfolio wins in public, this is the report to show them.