Casa's security chief maps 360 physical attacks on the people who hold their own keys

Twenty-three documented incidents across the first 11 weeks of 2026 works out to 2.1 a week, roughly double the 2025 average Lopp gives ^[1]. Cryptobriefing calls the 2026 run a continuation of that pace ^[7]. The list is community-maintained, and Lopp asks anyone holding details of an uncatalogued case to add it ^[9], so older years keep filling in after the fact. Either 2026 is running at twice the 2025 rate, or the 2025 rows are still incomplete. Carry more than one a week across a full year and at least 52 of the 360 recorded cases, about one in seven, sit inside 2025 alone ^[3].

Cryptobriefing says the true total is almost certainly above 360, because many victims never report publicly, out of embarrassment, fear of retaliation, or because their local police take little interest in crypto crime ^[10]. Haseeb Qureshi, working from the same repository, went through 269 of the incidents and rated more than half of them "Serious" ^[6]. More than half of 269 is at least 135 cases of armed robbery, kidnapping, or an assault causing significant injury ^[2][8]. A fatal attack in Mexico last September sits at the top of that scale ^[16].

Key security has nothing to say to an attacker who already has the holder in a room, because a wrench attack goes at the person holding the keys and not the keys ^[17]. The fixes the article lists are multi-signature setups, time-locked transactions and distributed key management ^[11], all built so the holder cannot reach the full balance under duress ^[12]. Each one makes the owner slower at spending his own money in exchange for being less useful to a kidnapper. Lopp is co-founder and chief security officer at Casa, which sells multi-signature custody, and the article notes that his job gives him a professional stake in publicising physical risk ^[2][13]. It also describes the dashboard as a public resource built on open data with no commercial pitch attached ^[14]. The article does not include prices for any of these services.

The dashboard filters by location, time period and severity, so someone weighing a meetup in a given city can check whether that city has a documented history of holders being targeted ^[18]. France recurs, with enough cases in recent years to draw national media coverage and push local crypto communities into issuing safety advisories ^[15]. The rows come from publicly reported incidents ^[3][10], so the French cluster is counting French reporting as much as French crime.

In my view, for anyone holding a balance worth a kidnapping, self-custody now carries a running personal-security cost and not a one-off software decision. The counter-case is straightforward: the number of people self-custodying meaningful sums has grown over the same years, and 360 cases spread across a larger population could be a flat or falling per-holder rate. Nothing in this dataset counts that population. What exists is 360 recorded cases in a list kept since at least 2014 ^[1][3], and 23 of them in the last 11 weeks ^[5].