Coming soon
Old crime, new speed. Personal security in 2026: AI, crypto and leaked data.
Our coming report looks at how AI and cryptocurrency change the threats a private person faces.
← Gart Research
Physical attacks to take crypto
Every recorded case of a physical attack to take cryptocurrency: how the attacks unfold, where and when they happen, and the database behind them.
← Gart Research
Physical attacks to take crypto
Every recorded case of a physical attack to take cryptocurrency: how the attacks unfold, where and when they happen, and the database behind them.
Cases by year
Purple: 2025, the last full year. Outlined: 2026, year in progress.
717documented cases since 2014
73countries
+43%cases in 2025 against 2024
Confirmed deaths47+in 38 of 717 attacks (5.3%)
Researched attacks
Select one to follow How attacks unfold.
Where the cases happened
Countries with the most cases
Purple: more than 20 cases.
Most recent cases
Cases by year
Purple: 2025, the last full year. Outlined: 2026, year in progress.
717documented cases since 2014
73countries
+43%cases in 2025 against 2024
Confirmed deaths47+in 38 of 717 attacks (5.3%)
Researched attacks
Select one to follow How attacks unfold.
Where the cases happened
Countries with the most cases
Purple: more than 20 cases.
Most recent cases
Loading the cases.
Show relevant cases
Swipe sideways to see all four steps, through to Outcome.
A case can carry more than one label in a step (a lure followed by a fake police stop, for example), so the labels of one step can add up to more than the number of cases. A line joins two labels that occur in the same case, and a thicker line is more cases. Dashed bars mark the gaps in each step: Unknown and Unconfirmed where the sources do not say what happened at that step, and No label fits where they describe an attack none of our labels covers.
Loading the cases.
Show relevant cases
Swipe sideways to see all four steps, through to Outcome.
A case can carry more than one label in a step (a lure followed by a fake police stop, for example), so the labels of one step can add up to more than the number of cases. A line joins two labels that occur in the same case, and a thicker line is more cases. Dashed bars mark the gaps in each step: Unknown and Unconfirmed where the sources do not say what happened at that step, and No label fits where they describe an attack none of our labels covers.
| When | Who | What left | How | Then |
|---|
Loading the record.
| When | Who | What left | How | Then |
|---|
Loading the record.
Gart app for family & teams
Hold one button to trigger your alert. Your location and your response plan go with it.
Gart app →
Free download
Personal OpSec Checklist
A sample of our operational security checklist. Gart Training clients receive the extended version in print.
Download the checklist →
Private advisory
Talk to a Gart advisor
One 90-minute call, on the topics you choose. Or one full day with our trainer.
Advisory & training →
Gart app for family & teams
Hold one button to trigger your alert. Your location and your response plan go with it.
Gart app →
Free download
Personal OpSec Checklist
A sample of our operational security checklist. Gart Training clients receive the extended version in print.
Download the checklist →
Private advisory
Talk to a Gart advisor
One 90-minute call, on the topics you choose. Or one full day with our trainer.
Advisory & training →
February 2026
Kidnapping, ransom and physical attacks: challenges in cryptocurrency security.
A full analysis of documented physical attacks against cryptocurrency holders: how targets are selected, how incidents unfold, and what changes the outcome. PDF and EPUB.
Read the summary →
Coming soon
Old crime, new speed. Personal security in 2026: AI, crypto and leaked data.
Our coming report looks at how AI and cryptocurrency change the threats a private person faces.
February 2026
Kidnapping, ransom and physical attacks: challenges in cryptocurrency security.
A full analysis of documented physical attacks against cryptocurrency holders: how targets are selected, how incidents unfold, and what changes the outcome. PDF and EPUB.
Read the summary →Credit line
Source: gart.io
- The records summarize public reporting. The linked articles belong to their publishers.
- Tell us where you used the data if you can. We read what gets built on it and we correct what you find wrong.
API
- Physical attacks
sqlite-stats2.gart.io/api/cases
Every case as JSON: date, country, location, description, summary, the labels of the four steps and source links. - It answers a plain GET without a key. How attacks unfold visualizes each attack in four steps.
Credit line
Source: gart.io
- The records summarize public reporting. The linked articles belong to their publishers.
- Tell us where you used the data if you can. We read what gets built on it and we correct what you find wrong.
API
- Physical attacks
sqlite-stats2.gart.io/api/cases
Every case as JSON: date, country, location, description, summary, the labels of the four steps and source links. - It answers a plain GET without a key. How attacks unfold visualizes each attack in four steps.
01
Public sources only
Every entry is a publicly reported incident with a link to its source.
02
Real numbers are higher
Many attacks and leaks are never reported. We estimate the real numbers are several times what the records show, so read every count here as a minimum.
03
Claims stay claims
Figures are the ones the company, the authorities or the researchers who found the data reported. What an attacker says is marked as a claim.
04
Four steps
We read every physical attack in four steps: targeting, how the attackers chose the victim; approach, how they got to the victim; attack, the type of attack; and outcome, how it ended and what the attackers obtained.
05
Labels
Each of the 4 steps has a fixed set of labels. A case can carry more than one label in each step, for example Attack: home invasion, followed by kidnapping.
06
Open to correction
If an entry is wrong or missing, write to us and we will check it against the sources.
Report a case or an error →01
Public sources only
Every entry is a publicly reported incident with a link to its source.
02
Real numbers are higher
Many attacks and leaks are never reported. We estimate the real numbers are several times what the records show, so read every count here as a minimum.
03
Claims stay claims
Figures are the ones the company, the authorities or the researchers who found the data reported. What an attacker says is marked as a claim.
04
Four steps
We read every physical attack in four steps: targeting, how the attackers chose the victim; approach, how they got to the victim; attack, the type of attack; and outcome, how it ended and what the attackers obtained.
05
Labels
Each of the 4 steps has a fixed set of labels. A case can carry more than one label in each step, for example Attack: home invasion, followed by kidnapping.
06
Open to correction
If an entry is wrong or missing, write to us and we will check it against the sources.
Report a case or an error →01Targeting
- Data leak
- Customer database, tax-report or exchange leak.
- Public records
- Address or tax records obtained legally.
- Insider
- Someone with inside access (an employee, former employee, driver, guard, contractor, or bank or agency staff) passed on the victim's holdings or movements, or used that access to attack. Also a handler who supplied the target.
- Organized by a relative or partner
- A relative or partner of the victim organized or enabled the attack.
- Acquaintance
- A friend or social contact turned attacker.
- Business counterparty
- Prior trades, investors, a business or debt dispute.
- Public profile
- Known as a crypto holder: interviews, influencer status, executive role, rich lists.
- Social media
- Targeted after specific posts or streams.
- Visible wealth
- Cars, watches, spending or lifestyle seen offline.
- Online contact or advert
- The victim's ad or profile on a platform was answered.
- Surveillance
- Followed, watched, tracked.
- Opportunistic
- No prior selection.
- Other
- Anything else.
- Unknown
- The sources do not say how the victim was chosen.
Was the attackers' information right?
- Correct
- The victim held crypto or assets roughly as the attackers believed.
- Wealth overestimated
- The victim held far less than the attackers believed, or none.
- Wrong person or address
- The attackers hit someone other than the intended holder (moved out, previous owner, namesake).
- Unknown
- The sources do not let us tell.
02Approach
- Social engineering: business or investment meeting
- Social engineering: sale / purchase lure
- A sale or purchase of something other than crypto.
- Social engineering: dating or sexual lure
- Social engineering: social invitation
- Friend, party, dinner, night out.
- Social engineering: pretext at the door
- A story told at the door with no claimed role (damage to report, asking for someone).
- Social engineering: other pretext
- Social engineering: lure not described
- The sources say the victim was lured and not how.
- P2P trade
- Any arranged meeting to exchange crypto or cash, whether or not the other side meant to trade.
- Authority misuse: fake police or official
- Authority misuse: serving police or official
- Authority misuse: service ruse (delivery, driver, worker)
- Includes fake taxis, fake rideshare and fake deliveries.
- Authority misuse: other claimed role
- Seized in the street or a public place
- Seized at or outside the home
- Grabbed at the door, gate, garage or car park of the home, without entry.
- Taken from the workplace
- Vehicle intercepted on the road
- Walked in
- Into a shop, exchange office or ATM site open to the public.
- Forced entry
- Into a home, hotel room, office or shop.
- Let in by an insider
- Break-in, nobody present
- Remote, no contact
- Unknown
- The sources do not say how the attackers got to the victim.
Who was attacked
Counted in people. A case can name more than one person.
- Holder
- The person believed to hold the crypto or assets.
- Relative or partner
- Family or partner of the holder, attacked alongside the holder, as leverage, or in the holder's place. A couple or family attacked together is holder plus relative or partner.
- Employee or guard
- Staff of the holder or of a crypto business.
- Wrong person or address
- Someone attacked in place of the intended holder, usually because the attackers had an outdated address (previous owner or tenant).
- Bystanders or neighbors
- Others present who were not family or staff of the holder: friends, co-occupants, a neighbor, a passenger, customers in a shop.
- Other
- A person the other groups do not cover, or the sources do not say who it was.
03Attack
- Kidnapping
- The victim is taken away or held at a place the attackers control; pre-selected, or ransom asked of third parties.
- Express kidnapping
- Not pre-selected, seized in public, made to pay from own funds on the spot or in a vehicle. All three are needed.
- Home invasion
- Occupants held in their own home, hotel room or office.
- Armed robbery
- Theft by force with a weapon, no extended holding.
- Robbery without a weapon
- Theft by force or assault, no weapon reported.
- Mugging
- Opportunistic street robbery.
- Burglary
- Theft from premises, a machine or an empty home, nobody confronted.
- Extortion without detention
- Threats in person or remote, nobody held.
- Theft by deception
- No force used.
- Swatting
- A false emergency report sends armed police to the victim.
- No label fits
- The sources describe an attack none of our labels covers.
Violence used
- Detention
- Anyone was held against their will, restrained or prevented from leaving, for any length of time: the holder, a relative, staff or a guard.
- Violence or torture
- Physical violence against a person: beaten, stabbed, shot, burned, tasered or tortured, or injured in the attack. Restraint is detention, a weapon only carried is weapons, and drugging is drugs or alcohol.
- Weapons
- A weapon was present or used: a firearm, knife, taser, pepper spray, or any object used as a weapon, a car included. Fists do not count, and neither do ties or tape used only to tie someone up.
- Drugs or alcohol
- The attackers used a drug or alcohol on the victim: a spiked drink, a sedative, an injection or forced drinking. The victim's own drinking does not count.
Values of violence used
Each of the four takes one value. The four steps count Yes only.
- Yes
- The sources report it as fact.
- No
- It surely did not happen: the sources say so, or the account rules it out (nobody was present).
- Threat only
- Violence or torture only. Threats of harm were made, such as a weapon pointed or a threat against the family, and no physical violence is reported.
- Unconfirmed
- A source asserts, alleges or charges it, or the sources disagree, and it is not established.
- Unknown
- The sources do not say, or say it was not disclosed. A flag the sources are silent on is Unknown, never No.
04Outcome
- Foiled
- Stopped before the attackers gained control of anyone. An attack that got no assets after holding or hurting someone is not foiled; see what the attackers obtained.
- Escaped
- The victim got away from the attackers by their own action (ran, jumped, slipped away).
- Fought off
- The victim, or someone with them, resisted physically and the attackers gave up and fled.
- Rescued
- Freed by police or other people.
- Released
- The attackers let the victim go, or left.
- Killed
- The victim died.
- Victim missing
- The victim has not been found, and neither a death nor a release is confirmed.
- Nobody held or hurt
- Burglary, swatting, remote cases.
- Unknown
- The sources do not say what happened at this step.
What the attackers obtained
- Crypto
- Cash
- Devices or seed
- Valuables
- Nothing
- Unconfirmed
- A taking is alleged or charged and not established, or the sources disagree.
- Unknown
- The sources do not say what, if anything, the attackers got.
01Targeting
- Data leak
- Customer database, tax-report or exchange leak.
- Public records
- Address or tax records obtained legally.
- Insider
- Someone with inside access (an employee, former employee, driver, guard, contractor, or bank or agency staff) passed on the victim's holdings or movements, or used that access to attack. Also a handler who supplied the target.
- Organized by a relative or partner
- A relative or partner of the victim organized or enabled the attack.
- Acquaintance
- A friend or social contact turned attacker.
- Business counterparty
- Prior trades, investors, a business or debt dispute.
- Public profile
- Known as a crypto holder: interviews, influencer status, executive role, rich lists.
- Social media
- Targeted after specific posts or streams.
- Visible wealth
- Cars, watches, spending or lifestyle seen offline.
- Online contact or advert
- The victim's ad or profile on a platform was answered.
- Surveillance
- Followed, watched, tracked.
- Opportunistic
- No prior selection.
- Other
- Anything else.
- Unknown
- The sources do not say how the victim was chosen.
Was the attackers' information right?
- Correct
- The victim held crypto or assets roughly as the attackers believed.
- Wealth overestimated
- The victim held far less than the attackers believed, or none.
- Wrong person or address
- The attackers hit someone other than the intended holder (moved out, previous owner, namesake).
- Unknown
- The sources do not let us tell.
02Approach
- Social engineering: business or investment meeting
- Social engineering: sale / purchase lure
- A sale or purchase of something other than crypto.
- Social engineering: dating or sexual lure
- Social engineering: social invitation
- Friend, party, dinner, night out.
- Social engineering: pretext at the door
- A story told at the door with no claimed role (damage to report, asking for someone).
- Social engineering: other pretext
- Social engineering: lure not described
- The sources say the victim was lured and not how.
- P2P trade
- Any arranged meeting to exchange crypto or cash, whether or not the other side meant to trade.
- Authority misuse: fake police or official
- Authority misuse: serving police or official
- Authority misuse: service ruse (delivery, driver, worker)
- Includes fake taxis, fake rideshare and fake deliveries.
- Authority misuse: other claimed role
- Seized in the street or a public place
- Seized at or outside the home
- Grabbed at the door, gate, garage or car park of the home, without entry.
- Taken from the workplace
- Vehicle intercepted on the road
- Walked in
- Into a shop, exchange office or ATM site open to the public.
- Forced entry
- Into a home, hotel room, office or shop.
- Let in by an insider
- Break-in, nobody present
- Remote, no contact
- Unknown
- The sources do not say how the attackers got to the victim.
Who was attacked
Counted in people. A case can name more than one person.
- Holder
- The person believed to hold the crypto or assets.
- Relative or partner
- Family or partner of the holder, attacked alongside the holder, as leverage, or in the holder's place. A couple or family attacked together is holder plus relative or partner.
- Employee or guard
- Staff of the holder or of a crypto business.
- Wrong person or address
- Someone attacked in place of the intended holder, usually because the attackers had an outdated address (previous owner or tenant).
- Bystanders or neighbors
- Others present who were not family or staff of the holder: friends, co-occupants, a neighbor, a passenger, customers in a shop.
- Other
- A person the other groups do not cover, or the sources do not say who it was.
03Attack
- Kidnapping
- The victim is taken away or held at a place the attackers control; pre-selected, or ransom asked of third parties.
- Express kidnapping
- Not pre-selected, seized in public, made to pay from own funds on the spot or in a vehicle. All three are needed.
- Home invasion
- Occupants held in their own home, hotel room or office.
- Armed robbery
- Theft by force with a weapon, no extended holding.
- Robbery without a weapon
- Theft by force or assault, no weapon reported.
- Mugging
- Opportunistic street robbery.
- Burglary
- Theft from premises, a machine or an empty home, nobody confronted.
- Extortion without detention
- Threats in person or remote, nobody held.
- Theft by deception
- No force used.
- Swatting
- A false emergency report sends armed police to the victim.
- No label fits
- The sources describe an attack none of our labels covers.
Violence used
- Detention
- Anyone was held against their will, restrained or prevented from leaving, for any length of time: the holder, a relative, staff or a guard.
- Violence or torture
- Physical violence against a person: beaten, stabbed, shot, burned, tasered or tortured, or injured in the attack. Restraint is detention, a weapon only carried is weapons, and drugging is drugs or alcohol.
- Weapons
- A weapon was present or used: a firearm, knife, taser, pepper spray, or any object used as a weapon, a car included. Fists do not count, and neither do ties or tape used only to tie someone up.
- Drugs or alcohol
- The attackers used a drug or alcohol on the victim: a spiked drink, a sedative, an injection or forced drinking. The victim's own drinking does not count.
Values of violence used
Each of the four takes one value. The four steps count Yes only.
- Yes
- The sources report it as fact.
- No
- It surely did not happen: the sources say so, or the account rules it out (nobody was present).
- Threat only
- Violence or torture only. Threats of harm were made, such as a weapon pointed or a threat against the family, and no physical violence is reported.
- Unconfirmed
- A source asserts, alleges or charges it, or the sources disagree, and it is not established.
- Unknown
- The sources do not say, or say it was not disclosed. A flag the sources are silent on is Unknown, never No.
04Outcome
- Foiled
- Stopped before the attackers gained control of anyone. An attack that got no assets after holding or hurting someone is not foiled; see what the attackers obtained.
- Escaped
- The victim got away from the attackers by their own action (ran, jumped, slipped away).
- Fought off
- The victim, or someone with them, resisted physically and the attackers gave up and fled.
- Rescued
- Freed by police or other people.
- Released
- The attackers let the victim go, or left.
- Killed
- The victim died.
- Victim missing
- The victim has not been found, and neither a death nor a release is confirmed.
- Nobody held or hurt
- Burglary, swatting, remote cases.
- Unknown
- The sources do not say what happened at this step.
What the attackers obtained
- Crypto
- Cash
- Devices or seed
- Valuables
- Nothing
- Unconfirmed
- A taking is alleged or charged and not established, or the sources disagree.
- Unknown
- The sources do not say what, if anything, the attackers got.
Stealth. Ready. Smart.
A personal risk management app and private advisory for founders, executives, investors and their families. Built by people working in cryptography, digital and physical security and continuity of operations.