TL;DR

An attacker disguised as a delivery driver stole $11 million in cryptocurrency and devices after restraining the victim.
The incident is the latest in the growing trend of “Wrench Attacks,” physical assaults against crypto-holders.
Investigators are simultaneously tracing devices, the blockchain, and victim profiles to recover the funds.

A violent crypto robbery was reported in San Francisco early last Saturday morning. A city resident was the victim, losing the sum of $11 million in cryptocurrencies. According to the local police report, the assailant posed as a delivery driver to gain the victim’s trust and enter the residence, located near 18th and Dolores streets in the Mission Dolores neighborhood.

The police report indicates that the suspect subdued the victim, threatening him with a firearm, tying his hands and feet, and forcing him to hand over the credentials of his cryptocurrency wallet, along with his laptop and a mobile phone.

The crypto robbery in San Francisco has become a trend that authorities have dubbed “Wrench Attacks,” physical assaults specifically targeting owners of digital assets.

Jameson Lopp, co-founder of Casa, a self-custody platform, and manager of a database that tracks these incidents, indicated that he has reports of over 60 cases of wrench attacks this year alone, doubling the figure from the previous year. The escalation of violence is notable, as exemplified by the recent murder of Russian crypto promoter Roman Novak and his wife in the United Arab Emirates.

The Struggle to Track the San Francisco Crypto Robbery on the Blockchain

For this particular case, cybercrime consultant David Sehyeon Baek explained that investigators are likely moving on three fronts simultaneously: devices, the blockchain, and the victim’s profile.

After the first 48 hours of the event, the priority is the hardware, attempting to trace the stolen phone and laptop, while securing the remaining assets on exchanges before the attackers can move them.

For their part, blockchain specialists work to identify the exact wallets and addresses involved, in order to track the fund outflows in real-time. Baek warns that forced transfers allow attackers to move cryptocurrencies “in a matter of minutes,” especially if routed through privacy-focused services. This contrasts with purely digital thefts, which are often flagged and frozen by platforms.

Although the identification and capture of the suspects in these crypto robberies is very possible, the most difficult part, and the “hard truth,” is the recovery of the stolen cryptocurrencies. The sophistication of these physical attacks underscores the need for crypto asset holders to strengthen not only their digital security but also their personal and operational security.

---

Filed under: News - @ November 24, 2025 4:27 pm