Physical attacks on crypto-asset holdersA verified global record, 2020–2026

Methodology

What is counted, how the cases were found, how each one was checked, and what the record cannot tell you.

Scope

The record covers physical attacks on people whose motive is the appropriation of crypto-assets, worldwide, from 1 January 2020 to 15 October 2026. Purely digital attacks are out of scope.

Included

  • Kidnapping, unlawful confinement, torture or threats used to obtain private keys, a seed phrase or a transfer
  • Home invasion and violent entry at a holder's home
  • Robbery during an in-person, over-the-counter trade
  • Attacks on a relative — spouse, child, parent — in order to reach the holder
  • Armed raids on mining farms and attacks on crypto ATMs
  • Attempts that failed, and cases where the attackers targeted the wrong person

Excluded

  • Hacking, phishing and remote theft of keys
  • Investment fraud and misappropriation without physical coercion
  • Theft by deception with no violence or threat
  • SIM-swap attacks with no physical component
  • Seizures carried out by a public authority
  • Thefts with no established connection to crypto-assets

Construction of the record

The starting point is the public list maintained by Jameson Lopp on GitHub, which held 307 cases since 2020 at the time of this release. That list is assembled from volunteer contributions and its coverage is uneven: France, the United States, the United Kingdom and Thailand are well represented; East Asia, Latin America, Africa and Eastern Europe much less so.

Searching therefore focused on local-language press in around thirty languages, alongside police and prosecution statements, court reporting and judgment databases. It was organised by geographic and linguistic area, then extended by cross-cutting searches on angles that keyword searches miss: court records, criminal networks with multiple victims, and killings whose crypto motive only surfaces at trial.

Each case was then verified. Sources were opened and read; the scope was rechecked; dates were corrected where a publication date had been taken for the date of the events; and a second independent source was sought. Duplicates were resolved case by case against the sources. The nature of the assets targeted and the outcome for the victim were classified from the text of the sources, case by case.

Since October 2026 the record is updated every week, with the same method: local-language news searches across 57 national editions, the reference list and its repository, judgment databases and police statements; each candidate is read and checked against its sources before it is added, and corrections to existing cases are made in the same pass. Every update is listed on the Updates page.

Of the 300 cases the reference list held when this record was first built, two were removed after verification as out of scope. 375 cases absent from that list were documented, most of them in Taiwan, Brazil, Russia, the United States, France, India and China. 351 of them are now in that list too, most through an import by its maintainer on 16 October 2026; the In reference list field shows which.

Source quality

The record cites 1,111 distinct links across 597 media outlets and institutions. 490 of 670 cases carry a second, independent source; the remainder rest on a single documented source, which is common for local-language crime reporting.

Confidence is recorded on each case: high where two independent sources were read, medium for a single documented source, low where the available material remains partial. Low-confidence cases should be checked before being quoted individually.

Named victims

Victims appear by name only where their identity was already published by the cited sources — typically because the case went to trial. Where sources describe the victim without naming them, the record does the same.

Limitations

  • The record measures reported attacks, not attacks committed. Many victims do not go to the police, either from fear of reprisals or because they do not want the size of their holdings made public.
  • Press coverage governs visibility. In countries where crime reporting is sparse, the figures shown are floors. The press freedom score is included in the data for each country so that this can be weighed.
  • Case counts are small for most countries. The confidence intervals attached to every rate are wide and frequently overlap; two countries adjacent in a ranking are generally not distinguishable.
  • Amounts are as reported, at the time of the events, with no later revaluation of the assets. A figure is available for 447 of the 670 cases.
  • The classification of targeted assets is a judgement made from the source text. Where the sources do not allow a determination, the case is marked undetermined and excluded from the per-capita rates.