If you are into Bitcoin for a while, you know the "$5 wrench attack": forget breaking the encryption, just physically coerce the person until they hand over the keys.

For years it was mostly a meme.

In 2026 it is a fast-growing category of violent crime, and the profile of who gets hurt has quietly shifted.

The numbers, from CertiK's Q1 2026 Wrench Attacks Report and French law enforcement (PNACO):

• These attacks rose 75% in 2025, then another 41% in Q1 2026 alone
• Europe now accounts for 82% of them worldwide, and France alone for 70%, roughly one attack every two and a half days
• More than $101M was extorted in just the first four months of 2026
• And most striking: more than half of this year's victims held no crypto at all

Price goes down but $5 dollar wrench attacks are going parabolic

That last point is the one people miss: the victims are increasingly spouses, children and elderly parents of holders, targeted either as direct victims or as leverage.

Your own operational security does not protect an elderly parent living 500km away or a kid at school in another city. And none of these relatives ever signed up to a crypto platform or consented to being in any database.

Here is where policy makes it worse.

Since January 2026, the EU's DAC8 directive forces crypto platforms to report each user's identity, home address, tax residence and full transaction history to tax authorities, including transactions with no relevance to any tax event.

That data is then set to be automatically exchanged across all 27 member states starting in 2027. It is, functionally, a continent-wide map of who holds crypto, roughly how much, and where they live.

The obvious objection is "government databases are secure."

The recent track record says otherwise:

• A French tax official was jailed in January 2026 for selling home addresses and tax profiles to criminals, specifically targeting crypto investors
• In Italy, corrupt police exfiltrated over a million tax, police and bank records (the Equalize case)
• In 18 months, more than 100 million records of French citizens were compromised from state or contractor databases
• The Waltio breach (a French crypto tax platform) reportedly fed directly into at least three kidnappings

So the question is not hypothetical. What happens when you take a dataset like that, tie real identities to crypto holdings and home addresses, and share it across every member state of the EU, at the exact moment physical attacks against holders and their families are accelerating?

There is a full, sourced breakdown here (EUR-Lex, OECD, CertiK, court records): https://dac8.com