France Just Reported 77 Crypto Kidnappings in Six Months. The Attackers Aren't Breaking Wallets — They're Breaking People, and Betting Your Whole Secret Is in One Head.

On June 30, 2026, France's Interior Minister, Laurent Nuñez, sat down with members of ADAN — the country's digital-asset industry association — and delivered a number that should end any remaining debate about whether physical coercion is a fringe risk. In the first half of 2026, France recorded 77 kidnappings, unlawful detentions, extortions, or attempts of those crimes tied to the crypto industry. The full-year 2025 total was 45. France now accounts for something on the order of 70% of every documented "wrench attack" in the world, at a pace that works out to roughly one every two and a half days. The government's emergency response has produced around 200 arrests and enrolled 724 people in a protection program, and the new plan pairs the state with the industry through a network of experts and deeper cooperation with the foreign countries where the organizers sit. Those are the actions of a government treating a category of crime as a genuine emergency, because it is one.

A "wrench attack" is the plainest threat model in all of cryptography, named after an old comic strip: instead of spending millions on computers to crack your encryption, the attacker spends five dollars on a wrench and hits you until you unlock it yourself. What France's figures describe is that joke industrialized — abduction, imprisonment, and in the worst cases torture, aimed at forcing a victim to move coins or surrender the keys that control them. The roster of 2026 is not anonymous. David Balland, a co-founder of Ledger, was abducted with his partner in January 2025 and mutilated — a severed finger sent as leverage — before police freed them. The wife of Sandbox co-founder Sébastien Borget escaped an attempted abduction. A French couple lost close to €900,000 after men posing as police forced their way inside. The pattern is consistent enough to be a business model: organized crews, often directed from abroad, recruiting local muscle to apply pressure to a specific person at a specific address.

The detail that should reframe how you think about this is where the addresses come from. These are not random home invasions; they are targeted, and the targeting runs on leaked data the victims never controlled. The 2020 Ledger e-commerce breach exposed names, home addresses, phone numbers, and purchase histories for more than 270,000 customers — a shopping list, in effect, of people known to own hardware wallets, keyed to where they sleep. In January 2026, hackers hit Waltio, a French crypto-tax platform, and walked off with data on roughly 50,000 users including their gains, losses, and year-end balances — not just who owns crypto, but who owns enough to be worth abducting. And in one of the more chilling cases, a former employee inside France's own tax administration was arrested for allegedly trafficking investors' details to criminal networks that used them to plan violent extortion. You cannot out-behave your way off these lists. The careful holder and the careless one appear on the same spreadsheet, and once a name and a balance and an address are on it, no amount of future vigilance pulls them back off.

So the real question the France numbers pose is not "how do I avoid being on a list" — that ship sailed with breaches you had no part in — but "when a determined person is standing in my home demanding everything, what am I actually able to give them?" This is the pivot most security advice misses, because most security advice is about keeping the secret away from remote attackers: keep keys offline, use a hardware wallet, never type your seed into a website. All good, all useless here. The wrench attack skips every one of those defenses by routing around the machine entirely and going straight at the human, who is assumed — correctly, in almost every setup — to be able to produce the complete secret on demand. The seed phrase in the safe, the steel plate in the closet, the twenty-four words in memory: each is a mechanism designed so that one person can reconstruct everything, quickly, alone. Under a wrench, that design is not protection. It is the vulnerability, because the attacker's entire wager is that the whole secret sits behind one frightened person and can be extracted in a single session.

It would be a lie to claim any technology makes you safe from violence, and this publication is not going to tell that lie. If someone is willing to hurt you, they can hurt you, and no cryptographic scheme changes that grim fact. What a scheme can change is the thing the attacker is actually after: whether the pain reliably produces the coins. That is the specific, narrow, honest claim of threshold custody, and it is worth stating precisely. When your encrypted seed phrase is split with Shamir's Secret Sharing into a threshold set of shares — say 3-of-5 — and those shares live in genuinely separate places and hands, a spouse, an attorney, a sibling, a safe-deposit box, a home safe, then there is no single person and no single location from which the complete secret can be produced. A victim held at their own address physically cannot hand over what is not there. Below the threshold, the shares an attacker can reach reveal nothing — not a little, but information-theoretically nothing, every possible seed equally consistent with what they hold. The captor can take the one share in the house and be no closer to the coins than before they broke the door.

The subtle part — and the part it would be dishonest to skip — is that this only helps if it is real, and if the attacker can be made to believe it is real. A threshold setup where the "shares" are all in the same house, or where you alone can call two custodians and talk them into reconstructing while a gun is at your back, has simply reintroduced the single point of failure with extra steps. The protection comes from arrangements that a coerced person genuinely cannot collapse alone: custodians in different cities, institutions with their own access procedures and timelines, people instructed in advance that a request made under duress is exactly the request to refuse. That is friction, and against a remote thief friction is merely inconvenient. Against a wrench attack, friction is the whole defense — because it converts "torture this person until they comply" into "coordinate a multi-party, multi-location reconstruction that no amount of pain in this one room can accelerate." The credible impossibility of instant compliance is what removes the incentive. There is little point abducting someone who cannot, even in principle, give you everything tonight.

This is also why the France plan, as serious as it is, can only ever be half an answer, and the minister would likely not dispute it. Arrests, protection programs, and international cooperation attack the supply of attackers. They do nothing about the structural fact that a typical self-custodian is a single interrogatable node holding a single reconstructable secret. As long as that is true, leaked lists plus a wrench will keep producing victims faster than any police force can produce convictions — and France's own prosecutors have struggled to convert this wave into convictions at all. The state can try to reduce how many attackers come for you. Only your architecture decides what they can leave with when they do. The two are not in competition; they are different layers, and the personal one is the only layer you fully control.

seQRets is built for that layer, and it is honest about its boundaries. Your encrypted seed phrase, split into QR-encoded threshold shares and distributed across the locations and people you choose — no servers, no accounts, and no single copy sitting behind one person for a wrench to reach. It will not un-leak your address, and it will not make you brave. What it changes is the wager the whole crime depends on: that everything you own is retrievable from one head, in one room, in one bad night. Take that wager off the table and the wrench has far less to break.