$11 Million Crypto Theft in Broad Daylight Is Latest in Increasingly Common $5 Wrench Attacks

In the quiet hum of a San Francisco morning, a routine knock at the door quickly turned into a nightmare of coercion and irreversible loss, as a man posing as a harmless delivery driver gained entry to a home in the Mission Dolores neighborhood through the simple ploy of requesting a signature to receive a package.

What followed was a brazen escalation with a gun drawn, duct tape binding the resident, and demands that included unlocking access to $11 million worth of crypto assets. The victim, known only as Joshua in an initial report from the San Francisco Chronicle, survived with some nondescript injuries, while the thief vanished.

While crypto hacks from a distance over the internet are rather common, this was a more troubling and physical home invasion for the purpose of theft. The victim, whom Y Combinator’s Garry Tan described as a friend in an X post, became the latest example of a vulnerability that has long plagued self-custody enthusiasts in crypto: the so-called $5 wrench attack.

Tan originally amplified the alarm regarding the attack on X, sharing security footage of the suspect’s approach to the home as a fake delivery person. However, Tan has since scrubbed the post from his timeline.

Joshua is far from alone, as these sorts of incidents have been popping up in the media with alarming frequency lately. Casa co-founder and Chief Security Officer Jameson Lopp has been mapping this surge in physical attacks on crypto users for quite some time. Drawing from an archive of media clippings he’s maintained for years, Lopp’s data reveals a stark uptick in kidnappings, home invasions, and outright abductions for the purpose of stealing crypto worldwide.

In a presentation at the Bitcoin 2025 conference earlier this year, Lopp laid it bare: This year is barreling toward a record number of these sorts of incidents, as reports related to this kind of activity tend to track the price of bitcoin itself. Lopp also pointed to an investigation conducted by the University of Cambridge that indicated the situation may be much worse than what is indicated by his own data. 

What are the actual risks of wrench attacks for bitcoin holders? What can you do to decrease your risks and improve your security posture? I break down the lessons we can learn from analyzing 200+ attacks in this keynote. pic.twitter.com/rUSPvly7kH

— Jameson Lopp (@lopp) August 7, 2025

The allure of this kind of crime is simple. Unlike traditional dollars or other fiat currencies tucked in a bank vault, cryptocurrencies like bitcoin transfer in an instant with no take-backs (with the exception of centrally-controlled digital assets like stablecoins that are subject to blacklists and seizure).

Just weeks ago in Bangkok, a 35-year-old Chinese national stepped toward a taxi on Mahaseth Road, only to be yanked into a sedan by a trio of assailants. Punches were thrown, then a brutal detour to an underground lair where fists and threats pried loose 50,000 baht in cash alongside 9,375 USDT, a stablecoin commonly known as Tether. The victim, bloodied and broken, complied under duress; however, authorities later netted the attackers at airports and condos, slapping on charges from robbery to wrongful confinement.

Across the Pacific in British Columbia, a family’s ordeal stretched into a 13-hour abyss of torment, sparked by impostors in postal uniforms at their doorstep. What began as a feigned delivery spiraled into beatings and bindings, culminating in the forced handover of $2 million in digital assets. The perpetrator of the attack was recently arrested, but others involved in the attack remain at large.

Another recent attack was reported in Oxfordshire, England, where five individuals cruising a rural stretch between Kidlington and Yarnton faced a swarm of masked intruders in their vehicle. In an incident that lasted no more than 30 minutes, the raiders snatched a £448,000 Rolex, mobile devices, and compelled one captive to send £1.1 million in cryptocurrency to unknown wallet addresses.

Lopp has poured his expertise into fortifying these fronts at Casa, where multisignature vaults and inheritance protocols are used to scatter private keys across trusted guardians, guarding against the single point of failure that is central to the $5 wrench attack. While the large number of such attacks already taking place is undoubtedly troubling, Lopp has indicated it’s still amateur hour, and such attacks could get much more sophisticated and professional over time.

Few folks appreciate that Bitcoin wrench attacks are currently carried out by amateurs. Just wait until the professionals show up.https://t.co/byXFdqx1YC

— Jameson Lopp (@lopp) March 29, 2025

Of course, in the shadow of these headlines, another quieter crypto exodus has unfolded. Why tempt fate with hardware wallets and homespun setups when exchanges or spot ETFs offer to take custody of these assets?

Platforms like Coinbase or BlackRock’s iShares Bitcoin Trust absorb the security burden for users, as long as individual private keys are handed over to these third-party custodians. It’s a pragmatic option for many, but it’s also at odds with the original vision of Bitcoin as a rebellion against centralized financial gatekeepers.

In trading autonomy for ease, holders reclaim peace of mind but forfeit the radical self-reliance that once defined the movement. But as the wrench attacks proliferate, crypto users must ensure they don’t also become a separate point of centralized failure and think about the potential physical diversification of the private keys associated with their wealth.